@serve.zone/interfaces 22.0.0 → 23.0.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (75) hide show
  1. package/changelog.md +12 -0
  2. package/dist_ts/00_commitinfo_data.js +1 -1
  3. package/dist_ts/appstore/types.d.ts +31 -16
  4. package/dist_ts/appstore/types.js +208 -11
  5. package/dist_ts/data/deploymentoperation.js +6 -20
  6. package/dist_ts/data/deploymentpreflight.d.ts +2 -6
  7. package/dist_ts/data/deploymentpreflight.js +1 -1
  8. package/dist_ts/data/hostedapp.d.ts +40 -14
  9. package/dist_ts/data/hostedapp.js +90 -1
  10. package/dist_ts/data/immutableimage.d.ts +30 -1
  11. package/dist_ts/data/immutableimage.js +103 -1
  12. package/dist_ts/data/index.d.ts +0 -2
  13. package/dist_ts/data/index.js +1 -3
  14. package/dist_ts/data/secret.d.ts +186 -13
  15. package/dist_ts/data/secret.js +543 -45
  16. package/dist_ts/data/service.d.ts +0 -39
  17. package/dist_ts/data/service.js +1 -77
  18. package/dist_ts/data/settings.d.ts +62 -43
  19. package/dist_ts/data/settings.js +34 -2
  20. package/dist_ts/platform/storage.d.ts +13 -14
  21. package/dist_ts/platform/storage.js +1 -1
  22. package/dist_ts/platform/storagemigration.d.ts +8 -8
  23. package/dist_ts/platform/storagemigration.golden.d.ts +2 -2
  24. package/dist_ts/platform/storagemigration.golden.js +19 -88
  25. package/dist_ts/platform/storagemigration.js +46 -58
  26. package/dist_ts/platform/types.d.ts +5 -19
  27. package/dist_ts/plugins.d.ts +2 -1
  28. package/dist_ts/plugins.js +3 -2
  29. package/dist_ts/requests/hostedapp.d.ts +12 -9
  30. package/dist_ts/requests/hostedapp.js +38 -1
  31. package/dist_ts/requests/index.d.ts +1 -3
  32. package/dist_ts/requests/index.js +2 -4
  33. package/dist_ts/requests/platform.d.ts +0 -1
  34. package/dist_ts/requests/secret.d.ts +23 -17
  35. package/dist_ts/requests/secret.js +161 -2
  36. package/dist_ts/requests/service.d.ts +0 -13
  37. package/dist_ts/requests/settings.d.ts +3 -3
  38. package/dist_ts/runtime.d.ts +78 -26
  39. package/dist_ts/runtime.js +219 -19
  40. package/package.json +2 -1
  41. package/readme.md +106 -28
  42. package/ts/00_commitinfo_data.ts +1 -1
  43. package/ts/appstore/types.ts +251 -25
  44. package/ts/data/deploymentoperation.ts +7 -31
  45. package/ts/data/deploymentpreflight.ts +2 -5
  46. package/ts/data/hostedapp.ts +144 -18
  47. package/ts/data/immutableimage.ts +150 -1
  48. package/ts/data/index.ts +0 -2
  49. package/ts/data/secret.ts +775 -53
  50. package/ts/data/service.ts +0 -118
  51. package/ts/data/settings.ts +70 -80
  52. package/ts/platform/storage.ts +15 -16
  53. package/ts/platform/storagemigration.golden.ts +18 -95
  54. package/ts/platform/storagemigration.ts +57 -87
  55. package/ts/platform/types.ts +6 -19
  56. package/ts/plugins.ts +2 -0
  57. package/ts/requests/hostedapp.ts +50 -9
  58. package/ts/requests/index.ts +0 -4
  59. package/ts/requests/platform.ts +0 -1
  60. package/ts/requests/secret.ts +204 -9
  61. package/ts/requests/service.ts +0 -16
  62. package/ts/requests/settings.ts +3 -3
  63. package/ts/runtime.ts +314 -41
  64. package/dist_ts/data/secretbundle.d.ts +0 -57
  65. package/dist_ts/data/secretbundle.js +0 -2
  66. package/dist_ts/data/secretgroup.d.ts +0 -52
  67. package/dist_ts/data/secretgroup.js +0 -2
  68. package/dist_ts/requests/secretbundle.d.ts +0 -75
  69. package/dist_ts/requests/secretbundle.js +0 -4
  70. package/dist_ts/requests/secretgroup.d.ts +0 -52
  71. package/dist_ts/requests/secretgroup.js +0 -4
  72. package/ts/data/secretbundle.ts +0 -65
  73. package/ts/data/secretgroup.ts +0 -58
  74. package/ts/requests/secretbundle.ts +0 -103
  75. package/ts/requests/secretgroup.ts +0 -74
@@ -1,11 +1,22 @@
1
+ import * as plugins from '../plugins.js';
1
2
  import { normalizeServiceAbsolutePath } from './service.js';
2
3
  /** Retired versions remain usable only through an already-accepted manifest. */
3
- export const isSecretVersionMaterialIssuable = (lifecycleStateArg) => lifecycleStateArg === 'active' || lifecycleStateArg === 'retired';
4
+ export const isSecretVersionMaterialIssuable = (lifecycleStateArg, referencedByAcceptedManifestArg) => lifecycleStateArg === 'active'
5
+ || (lifecycleStateArg === 'retired' && referencedByAcceptedManifestArg);
6
+ export const secretValueLimits = Object.freeze({
7
+ maximumBytes: 500 * 1024,
8
+ minimumGeneratedBytes: 16,
9
+ maximumGeneratedBytes: 64,
10
+ });
4
11
  export const resolvedSecretManifestReferencesEqual = (leftArg, rightArg) => (Boolean(leftArg)
5
12
  && Boolean(rightArg)
6
13
  && leftArg?.manifestId === rightArg?.manifestId
7
14
  && leftArg?.manifestDigest === rightArg?.manifestDigest
8
15
  && leftArg?.clusterId === rightArg?.clusterId
16
+ && leftArg?.imageRolloutId === rightArg?.imageRolloutId
17
+ && leftArg?.imageRolloutGeneration === rightArg?.imageRolloutGeneration
18
+ && leftArg?.requestedImageDigest === rightArg?.requestedImageDigest
19
+ && leftArg?.invocationDigest === rightArg?.invocationDigest
9
20
  && leftArg?.secretRolloutId === rightArg?.secretRolloutId
10
21
  && leftArg?.secretRolloutGeneration === rightArg?.secretRolloutGeneration);
11
22
  export const isResolvedSecretManifestReferenceAccepted = (stateArg, referenceArg, nowArg) => (resolvedSecretManifestReferencesEqual(stateArg.desiredManifest, referenceArg)
@@ -19,20 +30,42 @@ const secretKeyRegex = /^[A-Z_][A-Z0-9_]{0,252}$/;
19
30
  const secretDigestRegex = /^sha256:[a-f0-9]{64}$/;
20
31
  const secretManagementScopeRegex = /^(appstore|mail|oidc|webpush|platform|system):[A-Za-z0-9][A-Za-z0-9._-]{0,199}$/;
21
32
  const isRecord = (valueArg) => (Boolean(valueArg) && typeof valueArg === 'object' && !Array.isArray(valueArg));
33
+ const hasExactKeys = (valueArg, keysArg) => {
34
+ const actual = Object.keys(valueArg).sort();
35
+ const expected = [...keysArg].sort();
36
+ return JSON.stringify(actual) === JSON.stringify(expected);
37
+ };
38
+ const hasOnlyKeys = (valueArg, keysArg) => Object.keys(valueArg).every((keyArg) => keysArg.includes(keyArg));
22
39
  const isSecretIdentifier = (valueArg) => (typeof valueArg === 'string' && secretIdentifierRegex.test(valueArg));
23
40
  const isSecretKey = (valueArg) => (typeof valueArg === 'string' && secretKeyRegex.test(valueArg));
24
41
  const isSecretEnvironment = (valueArg) => (typeof valueArg === 'string' && secretEnvironmentRegex.test(valueArg));
42
+ export const validateSecretMutationId = (mutationIdArg) => (isSecretIdentifier(mutationIdArg)
43
+ ? []
44
+ : ['mutationId must be a canonical identifier']);
45
+ export const validateSecretOwner = (ownerArg) => {
46
+ if (!isRecord(ownerArg))
47
+ return ['secret owner must be an object'];
48
+ const shapeByKind = {
49
+ service: ['kind', 'serviceId'],
50
+ 'secret-set': ['kind', 'secretSetId'],
51
+ 'platform-provider': ['kind', 'providerConfigId'],
52
+ system: ['kind', 'systemId'],
53
+ };
54
+ const keys = shapeByKind[ownerArg.kind];
55
+ if (!keys || !hasExactKeys(ownerArg, [...keys])) {
56
+ return ['secret owner must use an exact supported owner schema'];
57
+ }
58
+ const idField = keys[1];
59
+ return isSecretIdentifier(ownerArg[idField])
60
+ ? []
61
+ : [`secret owner ${idField} must be canonical`];
62
+ };
25
63
  export const validateSecretManagementScope = (sourceArg, scopeArg) => {
26
64
  if (scopeArg === 'operator') {
27
65
  return sourceArg === 'operator'
28
66
  ? []
29
67
  : ['operator management scope requires operator source'];
30
68
  }
31
- if (scopeArg === 'legacy') {
32
- return sourceArg === 'legacy'
33
- ? []
34
- : ['legacy management scope requires legacy source'];
35
- }
36
69
  if (typeof scopeArg !== 'string' || !secretManagementScopeRegex.test(scopeArg)) {
37
70
  return ['management scope must be canonical'];
38
71
  }
@@ -43,19 +76,23 @@ export const validateSecretManagementScope = (sourceArg, scopeArg) => {
43
76
  export const validateSecretDelivery = (deliveryArg) => {
44
77
  if (!isRecord(deliveryArg))
45
78
  return ['delivery must be an object'];
46
- if (deliveryArg.type === 'environment') {
47
- return isSecretKey(deliveryArg.variableName)
48
- ? []
49
- : ['environment delivery variableName must be a canonical environment key'];
79
+ const isLauncher = deliveryArg.type === 'launcher-environment';
80
+ if (!isLauncher && deliveryArg.type !== 'file') {
81
+ return ['delivery type must be launcher-environment or file'];
50
82
  }
51
- if (deliveryArg.type !== 'file') {
52
- return ['delivery type must be environment or file'];
83
+ const expectedKeys = isLauncher
84
+ ? ['type', 'variableName', 'uid', 'gid', 'mode']
85
+ : ['type', 'targetPath', 'uid', 'gid', 'mode'];
86
+ if (!hasExactKeys(deliveryArg, expectedKeys)) {
87
+ return ['delivery must use its exact schema'];
53
88
  }
54
89
  const errors = [];
55
- if (typeof deliveryArg.targetPath !== 'string'
90
+ if (isLauncher && !isSecretKey(deliveryArg.variableName)) {
91
+ errors.push('launcher delivery variableName must be a canonical environment key');
92
+ }
93
+ if (!isLauncher && (typeof deliveryArg.targetPath !== 'string'
56
94
  || normalizeServiceAbsolutePath(deliveryArg.targetPath) !== deliveryArg.targetPath
57
- || !/^\/run\/secrets\/[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/.test(deliveryArg.targetPath)
58
- || deliveryArg.targetPath === '/run/secrets/secret.json') {
95
+ || !/^\/run\/secrets\/[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/.test(deliveryArg.targetPath))) {
59
96
  errors.push('file delivery targetPath must be a canonical file below /run/secrets');
60
97
  }
61
98
  for (const field of ['uid', 'gid']) {
@@ -63,14 +100,91 @@ export const validateSecretDelivery = (deliveryArg) => {
63
100
  if (!Number.isSafeInteger(value)
64
101
  || value < 0
65
102
  || value > 2_147_483_647) {
66
- errors.push(`file delivery ${field} must be a bounded numeric identity`);
103
+ errors.push(`${isLauncher ? 'launcher' : 'file'} delivery ${field} must be a bounded numeric identity`);
67
104
  }
68
105
  }
69
106
  if (deliveryArg.mode !== 0o400 && deliveryArg.mode !== 0o440) {
70
- errors.push('file delivery mode must be 0400 or 0440');
107
+ errors.push(`${isLauncher ? 'launcher' : 'file'} delivery mode must be 0400 or 0440`);
71
108
  }
72
109
  return errors;
73
110
  };
111
+ export const validateSecretValueInput = (valueInputArg) => {
112
+ if (!isRecord(valueInputArg))
113
+ return ['valueInput must be an object'];
114
+ if (valueInputArg.mode === 'sealed') {
115
+ if (!hasExactKeys(valueInputArg, ['mode', 'envelope'])) {
116
+ return ['sealed valueInput must use its exact schema'];
117
+ }
118
+ try {
119
+ const envelope = plugins.smartcrypto.parseX25519Envelope(valueInputArg.envelope);
120
+ return envelope.ciphertext.length
121
+ <= Math.ceil(secretValueLimits.maximumBytes * 4 / 3)
122
+ ? []
123
+ : [`sealed secret material must not exceed ${secretValueLimits.maximumBytes} bytes`];
124
+ }
125
+ catch {
126
+ return ['sealed valueInput envelope must be a strict X25519 envelope'];
127
+ }
128
+ }
129
+ if (valueInputArg.mode === 'generated') {
130
+ if (!hasExactKeys(valueInputArg, ['mode', 'encoding', 'bytes'])) {
131
+ return ['generated valueInput must use its exact schema'];
132
+ }
133
+ const errors = [];
134
+ if (valueInputArg.encoding !== 'hex' && valueInputArg.encoding !== 'base64url') {
135
+ errors.push('generated valueInput encoding must be hex or base64url');
136
+ }
137
+ if (!Number.isSafeInteger(valueInputArg.bytes)
138
+ || valueInputArg.bytes < secretValueLimits.minimumGeneratedBytes
139
+ || valueInputArg.bytes > secretValueLimits.maximumGeneratedBytes) {
140
+ errors.push('generated valueInput bytes are outside the supported bounds');
141
+ }
142
+ return errors;
143
+ }
144
+ return ['valueInput mode must be sealed or generated'];
145
+ };
146
+ const encodeBase64Url = (bytesArg) => {
147
+ let binary = '';
148
+ for (const byte of bytesArg)
149
+ binary += String.fromCharCode(byte);
150
+ return globalThis.btoa(binary)
151
+ .replace(/\+/g, '-')
152
+ .replace(/\//g, '_')
153
+ .replace(/=+$/, '');
154
+ };
155
+ /** Checks the SmartCrypto context digest without opening or decrypting the envelope. */
156
+ export const verifySecretEnvelopeContext = async (envelopeArg, contextArg) => {
157
+ if (!(contextArg instanceof Uint8Array))
158
+ return false;
159
+ let envelope;
160
+ try {
161
+ envelope = plugins.smartcrypto.parseX25519Envelope(envelopeArg);
162
+ }
163
+ catch {
164
+ return false;
165
+ }
166
+ const contextDigest = new Uint8Array(await globalThis.crypto.subtle.digest('SHA-256', new Uint8Array(contextArg)));
167
+ return envelope.contextDigest === encodeBase64Url(contextDigest);
168
+ };
169
+ /** Files accept arbitrary bytes; launcher values must be valid UTF-8 without NUL. */
170
+ export const validateSecretValueBytes = (valueBytesArg, deliveryArg) => {
171
+ if (!(valueBytesArg instanceof Uint8Array))
172
+ return ['secret material must be bytes'];
173
+ if (valueBytesArg.byteLength > secretValueLimits.maximumBytes) {
174
+ return [`secret material must not exceed ${secretValueLimits.maximumBytes} bytes`];
175
+ }
176
+ if (deliveryArg.type === 'file')
177
+ return [];
178
+ try {
179
+ const decoded = new TextDecoder('utf-8', { fatal: true }).decode(valueBytesArg);
180
+ return decoded.includes('\0')
181
+ ? ['launcher secret material must not contain NUL']
182
+ : [];
183
+ }
184
+ catch {
185
+ return ['launcher secret material must be valid UTF-8'];
186
+ }
187
+ };
74
188
  /**
75
189
  * One shared precedence rule for resolution and runtime verification.
76
190
  * A manifest is authoritative once published; before publication an attachment
@@ -83,16 +197,26 @@ export const validateServiceSecretConfiguration = (configurationArg) => {
83
197
  if (!isRecord(configurationArg)) {
84
198
  return ['secretConfiguration must be an object'];
85
199
  }
86
- if (configurationArg.schemaVersion !== 1) {
87
- return ['secretConfiguration schemaVersion must be 1'];
200
+ const errors = [];
201
+ if (!hasExactKeys(configurationArg, [
202
+ 'schemaVersion',
203
+ 'revision',
204
+ 'secretsRevision',
205
+ 'secretSetAttachments',
206
+ ])) {
207
+ errors.push('secretConfiguration must use its exact schema');
208
+ }
209
+ if (configurationArg.schemaVersion !== 2) {
210
+ errors.push('secretConfiguration schemaVersion must be 2');
88
211
  }
89
212
  if (!Array.isArray(configurationArg.secretSetAttachments)) {
90
- return ['secretSetAttachments must be an array'];
213
+ errors.push('secretSetAttachments must be an array');
214
+ return errors;
91
215
  }
92
216
  if (configurationArg.secretSetAttachments.length > 64) {
93
- return ['secretSetAttachments must contain at most 64 entries'];
217
+ errors.push('secretSetAttachments must contain at most 64 entries');
218
+ return errors;
94
219
  }
95
- const errors = [];
96
220
  if (!Number.isSafeInteger(configurationArg.revision)
97
221
  || configurationArg.revision < 0) {
98
222
  errors.push('secretConfiguration revision must be a non-negative integer');
@@ -108,6 +232,9 @@ export const validateServiceSecretConfiguration = (configurationArg) => {
108
232
  errors.push(`secretSetAttachments[${attachmentIndex}] must be an object`);
109
233
  continue;
110
234
  }
235
+ if (!hasOnlyKeys(candidate, ['id', 'secretSetId', 'environment', 'mappings'])) {
236
+ errors.push(`secretSetAttachments[${attachmentIndex}] contains unsupported fields`);
237
+ }
111
238
  if (!isSecretIdentifier(candidate.id)) {
112
239
  errors.push(`secretSetAttachments[${attachmentIndex}].id must be a canonical identifier`);
113
240
  }
@@ -137,6 +264,9 @@ export const validateServiceSecretConfiguration = (configurationArg) => {
137
264
  errors.push(`secretSetAttachments[${attachmentIndex}].mappings[${mappingIndex}] must be an object`);
138
265
  continue;
139
266
  }
267
+ if (!hasOnlyKeys(mappingCandidate, ['sourceKey', 'targetKey', 'delivery'])) {
268
+ errors.push(`secretSetAttachments[${attachmentIndex}].mappings[${mappingIndex}] contains unsupported fields`);
269
+ }
140
270
  if (!isSecretKey(mappingCandidate.sourceKey)) {
141
271
  errors.push(`secretSetAttachments[${attachmentIndex}].mappings[${mappingIndex}].sourceKey must be canonical`);
142
272
  }
@@ -169,21 +299,6 @@ export const validateServiceSecretConfiguration = (configurationArg) => {
169
299
  }
170
300
  return errors;
171
301
  };
172
- export const validateServiceSecretMode = (serviceDataArg) => {
173
- if (!isRecord(serviceDataArg))
174
- return ['service data must be an object'];
175
- const hasLegacyPrimary = typeof serviceDataArg.secretBundleId === 'string'
176
- && serviceDataArg.secretBundleId.length > 0;
177
- const hasLegacyAdditional = Array.isArray(serviceDataArg.additionalSecretBundleIds)
178
- && serviceDataArg.additionalSecretBundleIds.length > 0;
179
- if (serviceDataArg.secretConfiguration !== undefined
180
- && (hasLegacyPrimary || hasLegacyAdditional)) {
181
- return ['legacy SecretBundle references cannot be mixed with secretConfiguration'];
182
- }
183
- return serviceDataArg.secretConfiguration === undefined
184
- ? []
185
- : validateServiceSecretConfiguration(serviceDataArg.secretConfiguration);
186
- };
187
302
  export const validateSecretSetAttachmentOwnership = (configurationArg, serviceOrganizationIdArg, secretSetsArg) => {
188
303
  const errors = validateServiceSecretConfiguration(configurationArg);
189
304
  const secretSetsById = new Map(secretSetsArg.map((secretSetArg) => [
@@ -210,6 +325,10 @@ export const createResolvedSecretManifestDigestInput = (manifestArg) => JSON.str
210
325
  organizationId: manifestArg.organizationId,
211
326
  serviceId: manifestArg.serviceId,
212
327
  clusterId: manifestArg.clusterId,
328
+ imageRolloutId: manifestArg.imageRolloutId,
329
+ imageRolloutGeneration: manifestArg.imageRolloutGeneration,
330
+ requestedImageDigest: manifestArg.requestedImageDigest,
331
+ invocationDigest: manifestArg.invocationDigest,
213
332
  secretRolloutId: manifestArg.secretRolloutId,
214
333
  secretRolloutGeneration: manifestArg.secretRolloutGeneration,
215
334
  entries: manifestArg.entries.map((entryArg) => ({
@@ -226,10 +345,13 @@ export const createResolvedSecretManifestDigestInput = (manifestArg) => JSON.str
226
345
  kind: 'secret-set',
227
346
  secretSetId: entryArg.owner.secretSetId,
228
347
  },
229
- delivery: entryArg.delivery.type === 'environment'
348
+ delivery: entryArg.delivery.type === 'launcher-environment'
230
349
  ? {
231
- type: 'environment',
350
+ type: 'launcher-environment',
232
351
  variableName: entryArg.delivery.variableName,
352
+ uid: entryArg.delivery.uid,
353
+ gid: entryArg.delivery.gid,
354
+ mode: entryArg.delivery.mode,
233
355
  }
234
356
  : {
235
357
  type: 'file',
@@ -255,13 +377,32 @@ export const validateResolvedSecretManifest = (manifestArg) => {
255
377
  if (!isRecord(manifestArg))
256
378
  return ['secret manifest must be an object'];
257
379
  const errors = [];
258
- if (manifestArg.schemaVersion !== 1)
259
- errors.push('secret manifest schemaVersion must be 1');
380
+ if (!hasExactKeys(manifestArg, [
381
+ 'schemaVersion',
382
+ 'id',
383
+ 'digest',
384
+ 'organizationId',
385
+ 'serviceId',
386
+ 'clusterId',
387
+ 'imageRolloutId',
388
+ 'imageRolloutGeneration',
389
+ 'requestedImageDigest',
390
+ 'invocationDigest',
391
+ 'secretRolloutId',
392
+ 'secretRolloutGeneration',
393
+ 'entries',
394
+ 'createdAt',
395
+ ])) {
396
+ errors.push('secret manifest must use its exact schema');
397
+ }
398
+ if (manifestArg.schemaVersion !== 2)
399
+ errors.push('secret manifest schemaVersion must be 2');
260
400
  for (const field of [
261
401
  'id',
262
402
  'organizationId',
263
403
  'serviceId',
264
404
  'clusterId',
405
+ 'imageRolloutId',
265
406
  'secretRolloutId',
266
407
  ]) {
267
408
  if (!isSecretIdentifier(manifestArg[field])) {
@@ -271,6 +412,15 @@ export const validateResolvedSecretManifest = (manifestArg) => {
271
412
  if (typeof manifestArg.digest !== 'string' || !secretDigestRegex.test(manifestArg.digest)) {
272
413
  errors.push('secret manifest digest must be a canonical sha256 digest');
273
414
  }
415
+ for (const field of ['requestedImageDigest', 'invocationDigest']) {
416
+ if (typeof manifestArg[field] !== 'string' || !secretDigestRegex.test(manifestArg[field])) {
417
+ errors.push(`secret manifest ${field} must be a canonical sha256 digest`);
418
+ }
419
+ }
420
+ if (!Number.isSafeInteger(manifestArg.imageRolloutGeneration)
421
+ || manifestArg.imageRolloutGeneration < 1) {
422
+ errors.push('secret manifest image rollout generation must be a positive integer');
423
+ }
274
424
  if (!Number.isSafeInteger(manifestArg.secretRolloutGeneration)
275
425
  || manifestArg.secretRolloutGeneration < 1) {
276
426
  errors.push('secret manifest rollout generation must be a positive integer');
@@ -293,6 +443,16 @@ export const validateResolvedSecretManifest = (manifestArg) => {
293
443
  errors.push(`secret manifest entries[${index}] must be an object`);
294
444
  continue;
295
445
  }
446
+ if (!hasExactKeys(candidate, [
447
+ 'secretId',
448
+ 'secretVersionId',
449
+ 'key',
450
+ 'environment',
451
+ 'owner',
452
+ 'delivery',
453
+ ])) {
454
+ errors.push(`secret manifest entries[${index}] must use its exact schema`);
455
+ }
296
456
  if (!isSecretIdentifier(candidate.secretId)) {
297
457
  errors.push(`secret manifest entries[${index}].secretId must be canonical`);
298
458
  }
@@ -317,6 +477,9 @@ export const validateResolvedSecretManifest = (manifestArg) => {
317
477
  if (!isRecord(candidate.owner)
318
478
  || (candidate.owner.kind !== 'service'
319
479
  && candidate.owner.kind !== 'secret-set')
480
+ || !hasExactKeys(candidate.owner, candidate.owner.kind === 'service'
481
+ ? ['kind', 'serviceId']
482
+ : ['kind', 'secretSetId'])
320
483
  || (candidate.owner.kind === 'service'
321
484
  && !isSecretIdentifier(candidate.owner.serviceId))
322
485
  || (candidate.owner.kind === 'secret-set'
@@ -330,7 +493,7 @@ export const validateResolvedSecretManifest = (manifestArg) => {
330
493
  }
331
494
  errors.push(...validateSecretDelivery(candidate.delivery).map((errorArg) => `secret manifest entries[${index}].${errorArg}`));
332
495
  if (isRecord(candidate.delivery)) {
333
- if (candidate.delivery.type === 'environment'
496
+ if (candidate.delivery.type === 'launcher-environment'
334
497
  && isSecretKey(candidate.delivery.variableName)) {
335
498
  environmentDeliveryTargets.push(candidate.delivery.variableName);
336
499
  }
@@ -367,10 +530,28 @@ export const validateResolvedSecretManifest = (manifestArg) => {
367
530
  };
368
531
  const validateResolvedSecretManifestReference = (referenceArg, expectedClusterIdArg, pathArg) => {
369
532
  if (!isRecord(referenceArg)
533
+ || !hasExactKeys(referenceArg, [
534
+ 'manifestId',
535
+ 'manifestDigest',
536
+ 'clusterId',
537
+ 'imageRolloutId',
538
+ 'imageRolloutGeneration',
539
+ 'requestedImageDigest',
540
+ 'invocationDigest',
541
+ 'secretRolloutId',
542
+ 'secretRolloutGeneration',
543
+ ])
370
544
  || !isSecretIdentifier(referenceArg.manifestId)
371
545
  || typeof referenceArg.manifestDigest !== 'string'
372
546
  || !secretDigestRegex.test(referenceArg.manifestDigest)
373
547
  || referenceArg.clusterId !== expectedClusterIdArg
548
+ || !isSecretIdentifier(referenceArg.imageRolloutId)
549
+ || !Number.isSafeInteger(referenceArg.imageRolloutGeneration)
550
+ || referenceArg.imageRolloutGeneration < 1
551
+ || typeof referenceArg.requestedImageDigest !== 'string'
552
+ || !secretDigestRegex.test(referenceArg.requestedImageDigest)
553
+ || typeof referenceArg.invocationDigest !== 'string'
554
+ || !secretDigestRegex.test(referenceArg.invocationDigest)
374
555
  || !isSecretIdentifier(referenceArg.secretRolloutId)
375
556
  || !Number.isSafeInteger(referenceArg.secretRolloutGeneration)
376
557
  || referenceArg.secretRolloutGeneration < 1) {
@@ -382,8 +563,16 @@ export const validateServiceSecretDeploymentPlan = (planArg, expectedTargetClust
382
563
  if (!isRecord(planArg))
383
564
  return ['secret deployment plan must be an object'];
384
565
  const errors = [];
385
- if (planArg.schemaVersion !== 1)
386
- errors.push('secret deployment plan schemaVersion must be 1');
566
+ if (!hasExactKeys(planArg, [
567
+ 'schemaVersion',
568
+ 'revision',
569
+ 'clusterStates',
570
+ 'updatedAt',
571
+ ])) {
572
+ errors.push('secret deployment plan must use its exact schema');
573
+ }
574
+ if (planArg.schemaVersion !== 2)
575
+ errors.push('secret deployment plan schemaVersion must be 2');
387
576
  if (!Number.isSafeInteger(planArg.revision) || planArg.revision < 1) {
388
577
  errors.push('secret deployment plan revision must be a positive integer');
389
578
  }
@@ -418,6 +607,16 @@ export const validateServiceSecretDeploymentPlan = (planArg, expectedTargetClust
418
607
  errors.push(`${path}.clusterId must be canonical`);
419
608
  continue;
420
609
  }
610
+ if (!hasOnlyKeys(candidate, [
611
+ 'clusterId',
612
+ 'desiredManifest',
613
+ 'appliedManifest',
614
+ 'previousAcceptedManifest',
615
+ 'status',
616
+ 'updatedAt',
617
+ ])) {
618
+ errors.push(`${path} contains unsupported fields`);
619
+ }
421
620
  clusterIds.push(candidate.clusterId);
422
621
  validateAndTrackManifestReference(candidate.desiredManifest, candidate.clusterId, `${path}.desiredManifest`);
423
622
  if (candidate.appliedManifest !== undefined) {
@@ -425,6 +624,7 @@ export const validateServiceSecretDeploymentPlan = (planArg, expectedTargetClust
425
624
  }
426
625
  if (candidate.previousAcceptedManifest !== undefined) {
427
626
  if (!isRecord(candidate.previousAcceptedManifest)
627
+ || !hasExactKeys(candidate.previousAcceptedManifest, ['manifest', 'acceptedUntil'])
428
628
  || !Number.isSafeInteger(candidate.previousAcceptedManifest.acceptedUntil)
429
629
  || candidate.previousAcceptedManifest.acceptedUntil < 0) {
430
630
  errors.push(`${path}.previousAcceptedManifest acceptedUntil must be non-negative`);
@@ -466,4 +666,302 @@ export const validateServiceSecretDeploymentPlan = (planArg, expectedTargetClust
466
666
  }
467
667
  return errors;
468
668
  };
469
- //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2VjcmV0LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vdHMvZGF0YS9zZWNyZXQudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQ0EsT0FBTyxFQUFFLDRCQUE0QixFQUFFLE1BQU0sY0FBYyxDQUFDO0FBZ0I1RCxnRkFBZ0Y7QUFDaEYsTUFBTSxDQUFDLE1BQU0sK0JBQStCLEdBQUcsQ0FDN0MsaUJBQStDLEVBQ3RDLEVBQUUsQ0FBQyxpQkFBaUIsS0FBSyxRQUFRLElBQUksaUJBQWlCLEtBQUssU0FBUyxDQUFDO0FBeU9oRixNQUFNLENBQUMsTUFBTSxxQ0FBcUMsR0FBRyxDQUNuRCxPQUFxRCxFQUNyRCxRQUFzRCxFQUM3QyxFQUFFLENBQUMsQ0FDWixPQUFPLENBQUMsT0FBTyxDQUFDO09BQ2IsT0FBTyxDQUFDLFFBQVEsQ0FBQztPQUNqQixPQUFPLEVBQUUsVUFBVSxLQUFLLFFBQVEsRUFBRSxVQUFVO09BQzVDLE9BQU8sRUFBRSxjQUFjLEtBQUssUUFBUSxFQUFFLGNBQWM7T0FDcEQsT0FBTyxFQUFFLFNBQVMsS0FBSyxRQUFRLEVBQUUsU0FBUztPQUMxQyxPQUFPLEVBQUUsZUFBZSxLQUFLLFFBQVEsRUFBRSxlQUFlO09BQ3RELE9BQU8sRUFBRSx1QkFBdUIsS0FBSyxRQUFRLEVBQUUsdUJBQXVCLENBQzFFLENBQUM7QUFFRixNQUFNLENBQUMsTUFBTSx5Q0FBeUMsR0FBRyxDQUN2RCxRQUF1QyxFQUN2QyxZQUE4QyxFQUM5QyxNQUFjLEVBQ0wsRUFBRSxDQUFDLENBQ1oscUNBQXFDLENBQUMsUUFBUSxDQUFDLGVBQWUsRUFBRSxZQUFZLENBQUM7T0FDMUUscUNBQXFDLENBQUMsUUFBUSxDQUFDLGVBQWUsRUFBRSxZQUFZLENBQUM7T0FDN0UsQ0FDRCxPQUFPLENBQUMsUUFBUSxDQUFDLHdCQUF3QixDQUFDO1dBQ3ZDLE1BQU0sR0FBRyxRQUFRLENBQUMsd0JBQXlCLENBQUMsYUFBYTtXQUN6RCxxQ0FBcUMsQ0FDdEMsUUFBUSxDQUFDLHdCQUF5QixDQUFDLFFBQVEsRUFDM0MsWUFBWSxDQUNiLENBQ0YsQ0FDRixDQUFDO0FBRUYsTUFBTSxxQkFBcUIsR0FBRyxxQ0FBcUMsQ0FBQztBQUNwRSxNQUFNLHNCQUFzQixHQUFHLG1DQUFtQyxDQUFDO0FBQ25FLE1BQU0sY0FBYyxHQUFHLDBCQUEwQixDQUFDO0FBQ2xELE1BQU0saUJBQWlCLEdBQUcsdUJBQXVCLENBQUM7QUFDbEQsTUFBTSwwQkFBMEIsR0FDOUIsaUZBQWlGLENBQUM7QUFFcEYsTUFBTSxRQUFRLEdBQUcsQ0FBQyxRQUFpQixFQUF1QyxFQUFFLENBQUMsQ0FDM0UsT0FBTyxDQUFDLFFBQVEsQ0FBQyxJQUFJLE9BQU8sUUFBUSxLQUFLLFFBQVEsSUFBSSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLENBQzlFLENBQUM7QUFFRixNQUFNLGtCQUFrQixHQUFHLENBQUMsUUFBaUIsRUFBc0IsRUFBRSxDQUFDLENBQ3BFLE9BQU8sUUFBUSxLQUFLLFFBQVEsSUFBSSxxQkFBcUIsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLENBQ3JFLENBQUM7QUFFRixNQUFNLFdBQVcsR0FBRyxDQUFDLFFBQWlCLEVBQXNCLEVBQUUsQ0FBQyxDQUM3RCxPQUFPLFFBQVEsS0FBSyxRQUFRLElBQUksY0FBYyxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsQ0FDOUQsQ0FBQztBQUVGLE1BQU0sbUJBQW1CLEdBQUcsQ0FBQyxRQUFpQixFQUFzQixFQUFFLENBQUMsQ0FDckUsT0FBTyxRQUFRLEtBQUssUUFBUSxJQUFJLHNCQUFzQixDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsQ0FDdEUsQ0FBQztBQUVGLE1BQU0sQ0FBQyxNQUFNLDZCQUE2QixHQUFHLENBQzNDLFNBQWtDLEVBQ2xDLFFBQWlCLEVBQ1AsRUFBRTtJQUNaLElBQUksUUFBUSxLQUFLLFVBQVUsRUFBRSxDQUFDO1FBQzVCLE9BQU8sU0FBUyxLQUFLLFVBQVU7WUFDN0IsQ0FBQyxDQUFDLEVBQUU7WUFDSixDQUFDLENBQUMsQ0FBQyxvREFBb0QsQ0FBQyxDQUFDO0lBQzdELENBQUM7SUFDRCxJQUFJLFFBQVEsS0FBSyxRQUFRLEVBQUUsQ0FBQztRQUMxQixPQUFPLFNBQVMsS0FBSyxRQUFRO1lBQzNCLENBQUMsQ0FBQyxFQUFFO1lBQ0osQ0FBQyxDQUFDLENBQUMsZ0RBQWdELENBQUMsQ0FBQztJQUN6RCxDQUFDO0lBQ0QsSUFBSSxPQUFPLFFBQVEsS0FBSyxRQUFRLElBQUksQ0FBQywwQkFBMEIsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLEVBQUUsQ0FBQztRQUMvRSxPQUFPLENBQUMsb0NBQW9DLENBQUMsQ0FBQztJQUNoRCxDQUFDO0lBQ0QsT0FBTyxRQUFRLENBQUMsVUFBVSxDQUFDLEdBQUcsU0FBUyxHQUFHLENBQUM7UUFDekMsQ0FBQyxDQUFDLEVBQUU7UUFDSixDQUFDLENBQUMsQ0FBQyxzREFBc0QsQ0FBQyxDQUFDO0FBQy9ELENBQUMsQ0FBQztBQUVGLE1BQU0sQ0FBQyxNQUFNLHNCQUFzQixHQUFHLENBQUMsV0FBb0IsRUFBWSxFQUFFO0lBQ3ZFLElBQUksQ0FBQyxRQUFRLENBQUMsV0FBVyxDQUFDO1FBQUUsT0FBTyxDQUFDLDRCQUE0QixDQUFDLENBQUM7SUFDbEUsSUFBSSxXQUFXLENBQUMsSUFBSSxLQUFLLGFBQWEsRUFBRSxDQUFDO1FBQ3ZDLE9BQU8sV0FBVyxDQUFDLFdBQVcsQ0FBQyxZQUFZLENBQUM7WUFDMUMsQ0FBQyxDQUFDLEVBQUU7WUFDSixDQUFDLENBQUMsQ0FBQyx1RUFBdUUsQ0FBQyxDQUFDO0lBQ2hGLENBQUM7SUFDRCxJQUFJLFdBQVcsQ0FBQyxJQUFJLEtBQUssTUFBTSxFQUFFLENBQUM7UUFDaEMsT0FBTyxDQUFDLDJDQUEyQyxDQUFDLENBQUM7SUFDdkQsQ0FBQztJQUNELE1BQU0sTUFBTSxHQUFhLEVBQUUsQ0FBQztJQUM1QixJQUFJLE9BQU8sV0FBVyxDQUFDLFVBQVUsS0FBSyxRQUFRO1dBQ3pDLDRCQUE0QixDQUFDLFdBQVcsQ0FBQyxVQUFVLENBQUMsS0FBSyxXQUFXLENBQUMsVUFBVTtXQUMvRSxDQUFDLG9EQUFvRCxDQUFDLElBQUksQ0FBQyxXQUFXLENBQUMsVUFBVSxDQUFDO1dBQ2xGLFdBQVcsQ0FBQyxVQUFVLEtBQUssMEJBQTBCLEVBQUUsQ0FBQztRQUMzRCxNQUFNLENBQUMsSUFBSSxDQUFDLHNFQUFzRSxDQUFDLENBQUM7SUFDdEYsQ0FBQztJQUNELEtBQUssTUFBTSxLQUFLLElBQUksQ0FBQyxLQUFLLEVBQUUsS0FBSyxDQUFVLEVBQUUsQ0FBQztRQUM1QyxNQUFNLEtBQUssR0FBRyxXQUFXLENBQUMsS0FBSyxDQUFDLENBQUM7UUFDakMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxhQUFhLENBQUMsS0FBSyxDQUFDO2VBQzFCLEtBQWdCLEdBQUcsQ0FBQztlQUNwQixLQUFnQixHQUFHLGFBQWEsRUFBRSxDQUFDO1lBQ3ZDLE1BQU0sQ0FBQyxJQUFJLENBQUMsaUJBQWlCLEtBQUsscUNBQXFDLENBQUMsQ0FBQztRQUMzRSxDQUFDO0lBQ0gsQ0FBQztJQUNELElBQUksV0FBVyxDQUFDLElBQUksS0FBSyxLQUFLLElBQUksV0FBVyxDQUFDLElBQUksS0FBSyxLQUFLLEVBQUUsQ0FBQztRQUM3RCxNQUFNLENBQUMsSUFBSSxDQUFDLHlDQUF5QyxDQUFDLENBQUM7SUFDekQsQ0FBQztJQUNELE9BQU8sTUFBTSxDQUFDO0FBQ2hCLENBQUMsQ0FBQztBQUVGOzs7O0dBSUc7QUFDSCxNQUFNLENBQUMsTUFBTSxxQkFBcUIsR0FBRyxDQUFDLFdBSXJDLEVBQW1CLEVBQUUsQ0FBQyxDQUNyQixXQUFXLENBQUMsZ0JBQWdCO09BQ3pCLFdBQVcsQ0FBQyxrQkFBa0I7T0FDOUIsV0FBVyxDQUFDLGFBQWEsQ0FDN0IsQ0FBQztBQUVGLE1BQU0sQ0FBQyxNQUFNLGtDQUFrQyxHQUFHLENBQ2hELGdCQUF5QixFQUNmLEVBQUU7SUFDWixJQUFJLENBQUMsUUFBUSxDQUFDLGdCQUFnQixDQUFDLEVBQUUsQ0FBQztRQUNoQyxPQUFPLENBQUMsdUNBQXVDLENBQUMsQ0FBQztJQUNuRCxDQUFDO0lBQ0QsSUFBSSxnQkFBZ0IsQ0FBQyxhQUFhLEtBQUssQ0FBQyxFQUFFLENBQUM7UUFDekMsT0FBTyxDQUFDLDZDQUE2QyxDQUFDLENBQUM7SUFDekQsQ0FBQztJQUNELElBQUksQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLGdCQUFnQixDQUFDLG9CQUFvQixDQUFDLEVBQUUsQ0FBQztRQUMxRCxPQUFPLENBQUMsdUNBQXVDLENBQUMsQ0FBQztJQUNuRCxDQUFDO0lBQ0QsSUFBSSxnQkFBZ0IsQ0FBQyxvQkFBb0IsQ0FBQyxNQUFNLEdBQUcsRUFBRSxFQUFFLENBQUM7UUFDdEQsT0FBTyxDQUFDLHNEQUFzRCxDQUFDLENBQUM7SUFDbEUsQ0FBQztJQUNELE1BQU0sTUFBTSxHQUFhLEVBQUUsQ0FBQztJQUM1QixJQUFJLENBQUMsTUFBTSxDQUFDLGFBQWEsQ0FBQyxnQkFBZ0IsQ0FBQyxRQUFRLENBQUM7V0FDOUMsZ0JBQWdCLENBQUMsUUFBbUIsR0FBRyxDQUFDLEVBQUUsQ0FBQztRQUMvQyxNQUFNLENBQUMsSUFBSSxDQUFDLDZEQUE2RCxDQUFDLENBQUM7SUFDN0UsQ0FBQztJQUNELElBQUksQ0FBQyxNQUFNLENBQUMsYUFBYSxDQUFDLGdCQUFnQixDQUFDLGVBQWUsQ0FBQztXQUNyRCxnQkFBZ0IsQ0FBQyxlQUEwQixHQUFHLENBQUMsRUFBRSxDQUFDO1FBQ3RELE1BQU0sQ0FBQyxJQUFJLENBQUMsb0VBQW9FLENBQUMsQ0FBQztJQUNwRixDQUFDO0lBQ0QsTUFBTSxhQUFhLEdBQWEsRUFBRSxDQUFDO0lBQ25DLE1BQU0sa0JBQWtCLEdBQWEsRUFBRSxDQUFDO0lBQ3hDLEtBQUssTUFBTSxDQUFDLGVBQWUsRUFBRSxTQUFTLENBQUMsSUFBSSxnQkFBZ0IsQ0FBQyxvQkFBb0IsQ0FBQyxPQUFPLEVBQUUsRUFBRSxDQUFDO1FBQzNGLElBQUksQ0FBQyxRQUFRLENBQUMsU0FBUyxDQUFDLEVBQUUsQ0FBQztZQUN6QixNQUFNLENBQUMsSUFBSSxDQUFDLHdCQUF3QixlQUFlLHFCQUFxQixDQUFDLENBQUM7WUFDMUUsU0FBUztRQUNYLENBQUM7UUFDRCxJQUFJLENBQUMsa0JBQWtCLENBQUMsU0FBUyxDQUFDLEVBQUUsQ0FBQyxFQUFFLENBQUM7WUFDdEMsTUFBTSxDQUFDLElBQUksQ0FBQyx3QkFBd0IsZUFBZSxxQ0FBcUMsQ0FBQyxDQUFDO1FBQzVGLENBQUM7YUFBTSxDQUFDO1lBQ04sYUFBYSxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsRUFBRSxDQUFDLENBQUM7UUFDbkMsQ0FBQztRQUNELElBQUksQ0FBQyxrQkFBa0IsQ0FBQyxTQUFTLENBQUMsV0FBVyxDQUFDLEVBQUUsQ0FBQztZQUMvQyxNQUFNLENBQUMsSUFBSSxDQUNULHdCQUF3QixlQUFlLDhDQUE4QyxDQUN0RixDQUFDO1FBQ0osQ0FBQztRQUNELElBQUksQ0FBQyxtQkFBbUIsQ0FBQyxTQUFTLENBQUMsV0FBVyxDQUFDLEVBQUUsQ0FBQztZQUNoRCxNQUFNLENBQUMsSUFBSSxDQUNULHdCQUF3QixlQUFlLCtDQUErQyxDQUN2RixDQUFDO1FBQ0osQ0FBQztRQUNELElBQUksa0JBQWtCLENBQUMsU0FBUyxDQUFDLFdBQVcsQ0FBQztlQUN4QyxtQkFBbUIsQ0FBQyxTQUFTLENBQUMsV0FBVyxDQUFDLEVBQUUsQ0FBQztZQUNoRCxrQkFBa0IsQ0FBQyxJQUFJLENBQUMsR0FBRyxTQUFTLENBQUMsV0FBVyxLQUFLLFNBQVMsQ0FBQyxXQUFXLEVBQUUsQ0FBQyxDQUFDO1FBQ2hGLENBQUM7UUFDRCxJQUFJLFNBQVMsQ0FBQyxRQUFRLEtBQUssU0FBUztZQUFFLFNBQVM7UUFDL0MsSUFBSSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsU0FBUyxDQUFDLFFBQVEsQ0FBQyxJQUFJLFNBQVMsQ0FBQyxRQUFRLENBQUMsTUFBTSxHQUFHLEdBQUcsRUFBRSxDQUFDO1lBQzFFLE1BQU0sQ0FBQyxJQUFJLENBQUMsd0JBQXdCLGVBQWUsb0NBQW9DLENBQUMsQ0FBQztZQUN6RixTQUFTO1FBQ1gsQ0FBQztRQUNELE1BQU0sVUFBVSxHQUFhLEVBQUUsQ0FBQztRQUNoQyxNQUFNLFVBQVUsR0FBYSxFQUFFLENBQUM7UUFDaEMsS0FBSyxNQUFNLENBQUMsWUFBWSxFQUFFLGdCQUFnQixDQUFDLElBQUksU0FBUyxDQUFDLFFBQVEsQ0FBQyxPQUFPLEVBQUUsRUFBRSxDQUFDO1lBQzVFLElBQUksQ0FBQyxRQUFRLENBQUMsZ0JBQWdCLENBQUMsRUFBRSxDQUFDO2dCQUNoQyxNQUFNLENBQUMsSUFBSSxDQUNULHdCQUF3QixlQUFlLGNBQWMsWUFBWSxxQkFBcUIsQ0FDdkYsQ0FBQztnQkFDRixTQUFTO1lBQ1gsQ0FBQztZQUNELElBQUksQ0FBQyxXQUFXLENBQUMsZ0JBQWdCLENBQUMsU0FBUyxDQUFDLEVBQUUsQ0FBQztnQkFDN0MsTUFBTSxDQUFDLElBQUksQ0FDVCx3QkFBd0IsZUFBZSxjQUFjLFlBQVksK0JBQStCLENBQ2pHLENBQUM7WUFDSixDQUFDO2lCQUFNLENBQUM7Z0JBQ04sVUFBVSxDQUFDLElBQUksQ0FBQyxnQkFBZ0IsQ0FBQyxTQUFTLENBQUMsQ0FBQztZQUM5QyxDQUFDO1lBQ0QsTUFBTSxRQUFRLEdBQUcsZ0JBQWdCLENBQUMsU0FBUyxJQUFJLGdCQUFnQixDQUFDLFNBQVMsQ0FBQztZQUMxRSxJQUFJLENBQUMsV0FBVyxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUM7Z0JBQzNCLE1BQU0sQ0FBQyxJQUFJLENBQ1Qsd0JBQXdCLGVBQWUsY0FBYyxZQUFZLCtCQUErQixDQUNqRyxDQUFDO1lBQ0osQ0FBQztpQkFBTSxDQUFDO2dCQUNOLFVBQVUsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLENBQUM7WUFDNUIsQ0FBQztZQUNELElBQUksZ0JBQWdCLENBQUMsUUFBUSxLQUFLLFNBQVMsRUFBRSxDQUFDO2dCQUM1QyxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsc0JBQXNCLENBQUMsZ0JBQWdCLENBQUMsUUFBUSxDQUFDLENBQUMsR0FBRyxDQUNsRSxDQUFDLFFBQVEsRUFBRSxFQUFFLENBQUMsQ0FDWix3QkFBd0IsZUFBZSxjQUFjLFlBQVksS0FBSyxRQUFRLEVBQUUsQ0FDakYsQ0FDRixDQUFDLENBQUM7WUFDTCxDQUFDO1FBQ0gsQ0FBQztRQUNELElBQUksSUFBSSxHQUFHLENBQUMsVUFBVSxDQUFDLENBQUMsSUFBSSxLQUFLLFVBQVUsQ0FBQyxNQUFNLEVBQUUsQ0FBQztZQUNuRCxNQUFNLENBQUMsSUFBSSxDQUFDLHdCQUF3QixlQUFlLGlDQUFpQyxDQUFDLENBQUM7UUFDeEYsQ0FBQztRQUNELElBQUksSUFBSSxHQUFHLENBQUMsVUFBVSxDQUFDLENBQUMsSUFBSSxLQUFLLFVBQVUsQ0FBQyxNQUFNLEVBQUUsQ0FBQztZQUNuRCxNQUFNLENBQUMsSUFBSSxDQUFDLHdCQUF3QixlQUFlLGlDQUFpQyxDQUFDLENBQUM7UUFDeEYsQ0FBQztJQUNILENBQUM7SUFDRCxJQUFJLElBQUksR0FBRyxDQUFDLGFBQWEsQ0FBQyxDQUFDLElBQUksS0FBSyxhQUFhLENBQUMsTUFBTSxFQUFFLENBQUM7UUFDekQsTUFBTSxDQUFDLElBQUksQ0FBQyx5Q0FBeUMsQ0FBQyxDQUFDO0lBQ3pELENBQUM7SUFDRCxJQUFJLElBQUksR0FBRyxDQUFDLGtCQUFrQixDQUFDLENBQUMsSUFBSSxLQUFLLGtCQUFrQixDQUFDLE1BQU0sRUFBRSxDQUFDO1FBQ25FLE1BQU0sQ0FBQyxJQUFJLENBQUMsdURBQXVELENBQUMsQ0FBQztJQUN2RSxDQUFDO0lBQ0QsT0FBTyxNQUFNLENBQUM7QUFDaEIsQ0FBQyxDQUFDO0FBRUYsTUFBTSxDQUFDLE1BQU0seUJBQXlCLEdBQUcsQ0FBQyxjQUF1QixFQUFZLEVBQUU7SUFDN0UsSUFBSSxDQUFDLFFBQVEsQ0FBQyxjQUFjLENBQUM7UUFBRSxPQUFPLENBQUMsZ0NBQWdDLENBQUMsQ0FBQztJQUN6RSxNQUFNLGdCQUFnQixHQUFHLE9BQU8sY0FBYyxDQUFDLGNBQWMsS0FBSyxRQUFRO1dBQ3JFLGNBQWMsQ0FBQyxjQUFjLENBQUMsTUFBTSxHQUFHLENBQUMsQ0FBQztJQUM5QyxNQUFNLG1CQUFtQixHQUFHLEtBQUssQ0FBQyxPQUFPLENBQUMsY0FBYyxDQUFDLHlCQUF5QixDQUFDO1dBQzlFLGNBQWMsQ0FBQyx5QkFBeUIsQ0FBQyxNQUFNLEdBQUcsQ0FBQyxDQUFDO0lBQ3pELElBQUksY0FBYyxDQUFDLG1CQUFtQixLQUFLLFNBQVM7V0FDL0MsQ0FBQyxnQkFBZ0IsSUFBSSxtQkFBbUIsQ0FBQyxFQUFFLENBQUM7UUFDL0MsT0FBTyxDQUFDLHlFQUF5RSxDQUFDLENBQUM7SUFDckYsQ0FBQztJQUNELE9BQU8sY0FBYyxDQUFDLG1CQUFtQixLQUFLLFNBQVM7UUFDckQsQ0FBQyxDQUFDLEVBQUU7UUFDSixDQUFDLENBQUMsa0NBQWtDLENBQUMsY0FBYyxDQUFDLG1CQUFtQixDQUFDLENBQUM7QUFDN0UsQ0FBQyxDQUFDO0FBRUYsTUFBTSxDQUFDLE1BQU0sb0NBQW9DLEdBQUcsQ0FDbEQsZ0JBQTZDLEVBQzdDLHdCQUFnQyxFQUNoQyxhQUFtQyxFQUN6QixFQUFFO0lBQ1osTUFBTSxNQUFNLEdBQUcsa0NBQWtDLENBQUMsZ0JBQWdCLENBQUMsQ0FBQztJQUNwRSxNQUFNLGNBQWMsR0FBRyxJQUFJLEdBQUcsQ0FBQyxhQUFhLENBQUMsR0FBRyxDQUFDLENBQUMsWUFBWSxFQUFFLEVBQUUsQ0FBQztRQUNqRSxZQUFZLENBQUMsRUFBRTtRQUNmLFlBQVk7S0FDYixDQUFDLENBQUMsQ0FBQztJQUNKLEtBQUssTUFBTSxVQUFVLElBQUksZ0JBQWdCLENBQUMsb0JBQW9CLElBQUksRUFBRSxFQUFFLENBQUM7UUFDckUsTUFBTSxTQUFTLEdBQUcsY0FBYyxDQUFDLEdBQUcsQ0FBQyxVQUFVLENBQUMsV0FBVyxDQUFDLENBQUM7UUFDN0QsSUFBSSxDQUFDLFNBQVMsRUFBRSxDQUFDO1lBQ2YsTUFBTSxDQUFDLElBQUksQ0FBQyxhQUFhLFVBQVUsQ0FBQyxXQUFXLGlCQUFpQixDQUFDLENBQUM7UUFDcEUsQ0FBQzthQUFNLElBQUksU0FBUyxDQUFDLGNBQWMsS0FBSyx3QkFBd0IsRUFBRSxDQUFDO1lBQ2pFLE1BQU0sQ0FBQyxJQUFJLENBQUMsYUFBYSxVQUFVLENBQUMsV0FBVyxrQ0FBa0MsQ0FBQyxDQUFDO1FBQ3JGLENBQUM7YUFBTSxJQUFJLFNBQVMsQ0FBQyxjQUFjLEtBQUssUUFBUSxFQUFFLENBQUM7WUFDakQsTUFBTSxDQUFDLElBQUksQ0FBQyxhQUFhLFVBQVUsQ0FBQyxXQUFXLGdCQUFnQixDQUFDLENBQUM7UUFDbkUsQ0FBQztJQUNILENBQUM7SUFDRCxPQUFPLE1BQU0sQ0FBQztBQUNoQixDQUFDLENBQUM7QUFFRixNQUFNLENBQUMsTUFBTSx1Q0FBdUMsR0FBRyxDQUNyRCxXQUFvQyxFQUM1QixFQUFFLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQztJQUMxQixhQUFhLEVBQUUsV0FBVyxDQUFDLGFBQWE7SUFDeEMsRUFBRSxFQUFFLFdBQVcsQ0FBQyxFQUFFO0lBQ2xCLGNBQWMsRUFBRSxXQUFXLENBQUMsY0FBYztJQUMxQyxTQUFTLEVBQUUsV0FBVyxDQUFDLFNBQVM7SUFDaEMsU0FBUyxFQUFFLFdBQVcsQ0FBQyxTQUFTO0lBQ2hDLGVBQWUsRUFBRSxXQUFXLENBQUMsZUFBZTtJQUM1Qyx1QkFBdUIsRUFBRSxXQUFXLENBQUMsdUJBQXVCO0lBQzVELE9BQU8sRUFBRSxXQUFXLENBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQyxDQUFDLFFBQVEsRUFBRSxFQUFFLENBQUMsQ0FBQztRQUM5QyxRQUFRLEVBQUUsUUFBUSxDQUFDLFFBQVE7UUFDM0IsZUFBZSxFQUFFLFFBQVEsQ0FBQyxlQUFlO1FBQ3pDLEdBQUcsRUFBRSxRQUFRLENBQUMsR0FBRztRQUNqQixXQUFXLEVBQUUsUUFBUSxDQUFDLFdBQVc7UUFDakMsS0FBSyxFQUFFLFFBQVEsQ0FBQyxLQUFLLENBQUMsSUFBSSxLQUFLLFNBQVM7WUFDdEMsQ0FBQyxDQUFDO2dCQUNFLElBQUksRUFBRSxTQUFTO2dCQUNmLFNBQVMsRUFBRSxRQUFRLENBQUMsS0FBSyxDQUFDLFNBQVM7YUFDcEM7WUFDSCxDQUFDLENBQUM7Z0JBQ0UsSUFBSSxFQUFFLFlBQVk7Z0JBQ2xCLFdBQVcsRUFBRSxRQUFRLENBQUMsS0FBSyxDQUFDLFdBQVc7YUFDeEM7UUFDTCxRQUFRLEVBQUUsUUFBUSxDQUFDLFFBQVEsQ0FBQyxJQUFJLEtBQUssYUFBYTtZQUNoRCxDQUFDLENBQUM7Z0JBQ0UsSUFBSSxFQUFFLGFBQWE7Z0JBQ25CLFlBQVksRUFBRSxRQUFRLENBQUMsUUFBUSxDQUFDLFlBQVk7YUFDN0M7WUFDSCxDQUFDLENBQUM7Z0JBQ0UsSUFBSSxFQUFFLE1BQU07Z0JBQ1osVUFBVSxFQUFFLFFBQVEsQ0FBQyxRQUFRLENBQUMsVUFBVTtnQkFDeEMsR0FBRyxFQUFFLFFBQVEsQ0FBQyxRQUFRLENBQUMsR0FBRztnQkFDMUIsR0FBRyxFQUFFLFFBQVEsQ0FBQyxRQUFRLENBQUMsR0FBRztnQkFDMUIsSUFBSSxFQUFFLFFBQVEsQ0FBQyxRQUFRLENBQUMsSUFBSTthQUM3QjtLQUNOLENBQUMsQ0FBQztJQUNILFNBQVMsRUFBRSxXQUFXLENBQUMsU0FBUztDQUNqQyxDQUFDLENBQUM7QUFFSCxtRkFBbUY7QUFDbkYsTUFBTSxDQUFDLE1BQU0sbUNBQW1DLEdBQUcsS0FBSyxFQUN0RCxXQUFvQyxFQUNaLEVBQUU7SUFDMUIsTUFBTSxPQUFPLEdBQUcsSUFBSSxXQUFXLEVBQUUsQ0FBQyxNQUFNLENBQUMsdUNBQXVDLENBQUMsV0FBVyxDQUFDLENBQUMsQ0FBQztJQUMvRixNQUFNLFlBQVksR0FBRyxNQUFNLFVBQVUsQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FBQyxTQUFTLEVBQUUsT0FBTyxDQUFDLENBQUM7SUFDL0UsTUFBTSxTQUFTLEdBQUcsQ0FBQyxHQUFHLElBQUksVUFBVSxDQUFDLFlBQVksQ0FBQyxDQUFDO1NBQ2hELEdBQUcsQ0FBQyxDQUFDLE9BQU8sRUFBRSxFQUFFLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUMsQ0FBQyxRQUFRLENBQUMsQ0FBQyxFQUFFLEdBQUcsQ0FBQyxDQUFDO1NBQ3ZELElBQUksQ0FBQyxFQUFFLENBQUMsQ0FBQztJQUNaLE9BQU8sVUFBVSxTQUFTLEVBQW1CLENBQUM7QUFDaEQsQ0FBQyxDQUFDO0FBRUYsTUFBTSxDQUFDLE1BQU0sa0NBQWtDLEdBQUcsS0FBSyxFQUNyRCxXQUFvQyxFQUNsQixFQUFFLENBQUMsQ0FDckIsV0FBVyxDQUFDLE1BQU0sS0FBSyxNQUFNLG1DQUFtQyxDQUFDLFdBQVcsQ0FBQyxDQUM5RSxDQUFDO0FBRUYsTUFBTSxDQUFDLE1BQU0sOEJBQThCLEdBQUcsQ0FDNUMsV0FBb0IsRUFDVixFQUFFO0lBQ1osSUFBSSxDQUFDLFFBQVEsQ0FBQyxXQUFXLENBQUM7UUFBRSxPQUFPLENBQUMsbUNBQW1DLENBQUMsQ0FBQztJQUN6RSxNQUFNLE1BQU0sR0FBYSxFQUFFLENBQUM7SUFDNUIsSUFBSSxXQUFXLENBQUMsYUFBYSxLQUFLLENBQUM7UUFBRSxNQUFNLENBQUMsSUFBSSxDQUFDLHlDQUF5QyxDQUFDLENBQUM7SUFDNUYsS0FBSyxNQUFNLEtBQUssSUFBSTtRQUNsQixJQUFJO1FBQ0osZ0JBQWdCO1FBQ2hCLFdBQVc7UUFDWCxXQUFXO1FBQ1gsaUJBQWlCO0tBQ1QsRUFBRSxDQUFDO1FBQ1gsSUFBSSxDQUFDLGtCQUFrQixDQUFDLFdBQVcsQ0FBQyxLQUFLLENBQUMsQ0FBQyxFQUFFLENBQUM7WUFDNUMsTUFBTSxDQUFDLElBQUksQ0FBQyxtQkFBbUIsS0FBSyxpQ0FBaUMsQ0FBQyxDQUFDO1FBQ3pFLENBQUM7SUFDSCxDQUFDO0lBQ0QsSUFBSSxPQUFPLFdBQVcsQ0FBQyxNQUFNLEtBQUssUUFBUSxJQUFJLENBQUMsaUJBQWlCLENBQUMsSUFBSSxDQUFDLFdBQVcsQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDO1FBQzFGLE1BQU0sQ0FBQyxJQUFJLENBQUMsMERBQTBELENBQUMsQ0FBQztJQUMxRSxDQUFDO0lBQ0QsSUFBSSxDQUFDLE1BQU0sQ0FBQyxhQUFhLENBQUMsV0FBVyxDQUFDLHVCQUF1QixDQUFDO1dBQ3hELFdBQVcsQ0FBQyx1QkFBa0MsR0FBRyxDQUFDLEVBQUUsQ0FBQztRQUN6RCxNQUFNLENBQUMsSUFBSSxDQUFDLCtEQUErRCxDQUFDLENBQUM7SUFDL0UsQ0FBQztJQUNELElBQUksQ0FBQyxNQUFNLENBQUMsYUFBYSxDQUFDLFdBQVcsQ0FBQyxTQUFTLENBQUMsSUFBSyxXQUFXLENBQUMsU0FBb0IsR0FBRyxDQUFDLEVBQUUsQ0FBQztRQUMxRixNQUFNLENBQUMsSUFBSSxDQUFDLDBEQUEwRCxDQUFDLENBQUM7SUFDMUUsQ0FBQztJQUNELElBQUksQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLFdBQVcsQ0FBQyxPQUFPLENBQUMsSUFBSSxXQUFXLENBQUMsT0FBTyxDQUFDLE1BQU0sR0FBRyxHQUFHLEVBQUUsQ0FBQztRQUM1RSxNQUFNLENBQUMsSUFBSSxDQUFDLGlEQUFpRCxDQUFDLENBQUM7UUFDL0QsT0FBTyxNQUFNLENBQUM7SUFDaEIsQ0FBQztJQUNELE1BQU0sU0FBUyxHQUFhLEVBQUUsQ0FBQztJQUMvQixNQUFNLFNBQVMsR0FBYSxFQUFFLENBQUM7SUFDL0IsTUFBTSxVQUFVLEdBQWEsRUFBRSxDQUFDO0lBQ2hDLE1BQU0sMEJBQTBCLEdBQWEsRUFBRSxDQUFDO0lBQ2hELE1BQU0sbUJBQW1CLEdBQWEsRUFBRSxDQUFDO0lBQ3pDLElBQUksZUFBbUMsQ0FBQztJQUN4QyxLQUFLLE1BQU0sQ0FBQyxLQUFLLEVBQUUsU0FBUyxDQUFDLElBQUksV0FBVyxDQUFDLE9BQU8sQ0FBQyxPQUFPLEVBQUUsRUFBRSxDQUFDO1FBQy9ELElBQUksQ0FBQyxRQUFRLENBQUMsU0FBUyxDQUFDLEVBQUUsQ0FBQztZQUN6QixNQUFNLENBQUMsSUFBSSxDQUFDLDJCQUEyQixLQUFLLHFCQUFxQixDQUFDLENBQUM7WUFDbkUsU0FBUztRQUNYLENBQUM7UUFDRCxJQUFJLENBQUMsa0JBQWtCLENBQUMsU0FBUyxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUM7WUFDNUMsTUFBTSxDQUFDLElBQUksQ0FBQywyQkFBMkIsS0FBSyw4QkFBOEIsQ0FBQyxDQUFDO1FBQzlFLENBQUM7YUFBTSxDQUFDO1lBQ04sU0FBUyxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsUUFBUSxDQUFDLENBQUM7UUFDckMsQ0FBQztRQUNELElBQUksQ0FBQyxrQkFBa0IsQ0FBQyxTQUFTLENBQUMsZUFBZSxDQUFDLEVBQUUsQ0FBQztZQUNuRCxNQUFNLENBQUMsSUFBSSxDQUFDLDJCQUEyQixLQUFLLHFDQUFxQyxDQUFDLENBQUM7UUFDckYsQ0FBQzthQUFNLENBQUM7WUFDTixVQUFVLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxlQUFlLENBQUMsQ0FBQztRQUM3QyxDQUFDO1FBQ0QsSUFBSSxDQUFDLFdBQVcsQ0FBQyxTQUFTLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQztZQUNoQyxNQUFNLENBQUMsSUFBSSxDQUFDLDJCQUEyQixLQUFLLHlCQUF5QixDQUFDLENBQUM7UUFDekUsQ0FBQztRQUNELElBQUksQ0FBQyxtQkFBbUIsQ0FBQyxTQUFTLENBQUMsV0FBVyxDQUFDLEVBQUUsQ0FBQztZQUNoRCxNQUFNLENBQUMsSUFBSSxDQUFDLDJCQUEyQixLQUFLLGlDQUFpQyxDQUFDLENBQUM7UUFDakYsQ0FBQzthQUFNLElBQUksV0FBVyxDQUFDLFNBQVMsQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDO1lBQ3RDLFNBQVMsQ0FBQyxJQUFJLENBQUMsR0FBRyxTQUFTLENBQUMsV0FBVyxLQUFLLFNBQVMsQ0FBQyxHQUFHLEVBQUUsQ0FBQyxDQUFDO1FBQy9ELENBQUM7UUFDRCxJQUFJLENBQUMsUUFBUSxDQUFDLFNBQVMsQ0FBQyxLQUFLLENBQUM7ZUFDekIsQ0FDRCxTQUFTLENBQUMsS0FBSyxDQUFDLElBQUksS0FBSyxTQUFTO21CQUMvQixTQUFTLENBQUMsS0FBSyxDQUFDLElBQUksS0FBSyxZQUFZLENBQ3pDO2VBQ0UsQ0FDRCxTQUFTLENBQUMsS0FBSyxDQUFDLElBQUksS0FBSyxTQUFTO21CQUMvQixDQUFDLGtCQUFrQixDQUFDLFNBQVMsQ0FBQyxLQUFLLENBQUMsU0FBUyxDQUFDLENBQ2xEO2VBQ0UsQ0FDRCxTQUFTLENBQUMsS0FBSyxDQUFDLElBQUksS0FBSyxZQUFZO21CQUNsQyxDQUFDLGtCQUFrQixDQUFDLFNBQVMsQ0FBQyxLQUFLLENBQUMsV0FBVyxDQUFDLENBQ3RELEVBQUUsQ0FBQztZQUNGLE1BQU0sQ0FBQyxJQUFJLENBQUMsMkJBQTJCLEtBQUssMkJBQTJCLENBQUMsQ0FBQztRQUMzRSxDQUFDO2FBQU0sSUFDTCxTQUFTLENBQUMsS0FBSyxDQUFDLElBQUksS0FBSyxTQUFTO2VBQy9CLGtCQUFrQixDQUFDLFdBQVcsQ0FBQyxTQUFTLENBQUM7ZUFDekMsU0FBUyxDQUFDLEtBQUssQ0FBQyxTQUFTLEtBQUssV0FBVyxDQUFDLFNBQVMsRUFDdEQsQ0FBQztZQUNELE1BQU0sQ0FBQyxJQUFJLENBQ1QsMkJBQTJCLEtBQUsscURBQXFELENBQ3RGLENBQUM7UUFDSixDQUFDO1FBQ0QsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLHNCQUFzQixDQUFDLFNBQVMsQ0FBQyxRQUFRLENBQUMsQ0FBQyxHQUFHLENBQzNELENBQUMsUUFBUSxFQUFFLEVBQUUsQ0FBQywyQkFBMkIsS0FBSyxLQUFLLFFBQVEsRUFBRSxDQUM5RCxDQUFDLENBQUM7UUFDSCxJQUFJLFFBQVEsQ0FBQyxTQUFTLENBQUMsUUFBUSxDQUFDLEVBQUUsQ0FBQztZQUNqQyxJQUNFLFNBQVMsQ0FBQyxRQUFRLENBQUMsSUFBSSxLQUFLLGFBQWE7bUJBQ3RDLFdBQVcsQ0FBQyxTQUFTLENBQUMsUUFBUSxDQUFDLFlBQVksQ0FBQyxFQUMvQyxDQUFDO2dCQUNELDBCQUEwQixDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsUUFBUSxDQUFDLFlBQVksQ0FBQyxDQUFDO1lBQ25FLENBQUM7aUJBQU0sSUFDTCxTQUFTLENBQUMsUUFBUSxDQUFDLElBQUksS0FBSyxNQUFNO21CQUMvQixPQUFPLFNBQVMsQ0FBQyxRQUFRLENBQUMsVUFBVSxLQUFLLFFBQVE7bUJBQ2pELHNCQUFzQixDQUFDLFNBQVMsQ0FBQyxRQUFRLENBQUMsQ0FBQyxNQUFNLEtBQUssQ0FBQyxFQUMxRCxDQUFDO2dCQUNELG1CQUFtQixDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsUUFBUSxDQUFDLFVBQVUsQ0FBQyxDQUFDO1lBQzFELENBQUM7UUFDSCxDQUFDO1FBQ0QsSUFBSSxXQUFXLENBQUMsU0FBUyxDQUFDLEdBQUcsQ0FBQyxJQUFJLG1CQUFtQixDQUFDLFNBQVMsQ0FBQyxXQUFXLENBQUMsRUFBRSxDQUFDO1lBQzdFLE1BQU0sT0FBTyxHQUFHLEdBQUcsU0FBUyxDQUFDLFdBQVcsS0FBSyxTQUFTLENBQUMsR0FBRyxFQUFFLENBQUM7WUFDN0QsSUFBSSxlQUFlLEtBQUssU0FBUyxJQUFJLE9BQU8sSUFBSSxlQUFlLEVBQUUsQ0FBQztnQkFDaEUsTUFBTSxDQUFDLElBQUksQ0FBQyx3RUFBd0UsQ0FBQyxDQUFDO1lBQ3hGLENBQUM7WUFDRCxlQUFlLEdBQUcsT0FBTyxDQUFDO1FBQzVCLENBQUM7SUFDSCxDQUFDO0lBQ0QsSUFBSSxJQUFJLEdBQUcsQ0FBQyxTQUFTLENBQUMsQ0FBQyxJQUFJLEtBQUssU0FBUyxDQUFDLE1BQU0sRUFBRSxDQUFDO1FBQ2pELE1BQU0sQ0FBQyxJQUFJLENBQUMsMkRBQTJELENBQUMsQ0FBQztJQUMzRSxDQUFDO0lBQ0QsSUFBSSxJQUFJLEdBQUcsQ0FBQyxTQUFTLENBQUMsQ0FBQyxJQUFJLEtBQUssU0FBUyxDQUFDLE1BQU0sRUFBRSxDQUFDO1FBQ2pELE1BQU0sQ0FBQyxJQUFJLENBQUMsMERBQTBELENBQUMsQ0FBQztJQUMxRSxDQUFDO0lBQ0QsSUFBSSxJQUFJLEdBQUcsQ0FBQyxVQUFVLENBQUMsQ0FBQyxJQUFJLEtBQUssVUFBVSxDQUFDLE1BQU0sRUFBRSxDQUFDO1FBQ25ELE1BQU0sQ0FBQyxJQUFJLENBQUMsbURBQW1ELENBQUMsQ0FBQztJQUNuRSxDQUFDO0lBQ0QsSUFBSSxJQUFJLEdBQUcsQ0FBQywwQkFBMEIsQ0FBQyxDQUFDLElBQUksS0FBSywwQkFBMEIsQ0FBQyxNQUFNLEVBQUUsQ0FBQztRQUNuRixNQUFNLENBQUMsSUFBSSxDQUFDLHNFQUFzRSxDQUFDLENBQUM7SUFDdEYsQ0FBQztJQUNELElBQUksSUFBSSxHQUFHLENBQUMsbUJBQW1CLENBQUMsQ0FBQyxJQUFJLEtBQUssbUJBQW1CLENBQUMsTUFBTSxFQUFFLENBQUM7UUFDckUsTUFBTSxDQUFDLElBQUksQ0FBQywrREFBK0QsQ0FBQyxDQUFDO0lBQy9FLENBQUM7SUFDRCxPQUFPLE1BQU0sQ0FBQztBQUNoQixDQUFDLENBQUM7QUFFRixNQUFNLHVDQUF1QyxHQUFHLENBQzlDLFlBQXFCLEVBQ3JCLG9CQUE0QixFQUM1QixPQUFlLEVBQ0wsRUFBRTtJQUNaLElBQUksQ0FBQyxRQUFRLENBQUMsWUFBWSxDQUFDO1dBQ3RCLENBQUMsa0JBQWtCLENBQUMsWUFBWSxDQUFDLFVBQVUsQ0FBQztXQUM1QyxPQUFPLFlBQVksQ0FBQyxjQUFjLEtBQUssUUFBUTtXQUMvQyxDQUFDLGlCQUFpQixDQUFDLElBQUksQ0FBQyxZQUFZLENBQUMsY0FBYyxDQUFDO1dBQ3BELFlBQVksQ0FBQyxTQUFTLEtBQUssb0JBQW9CO1dBQy9DLENBQUMsa0JBQWtCLENBQUMsWUFBWSxDQUFDLGVBQWUsQ0FBQztXQUNqRCxDQUFDLE1BQU0sQ0FBQyxhQUFhLENBQUMsWUFBWSxDQUFDLHVCQUF1QixDQUFDO1dBQzFELFlBQVksQ0FBQyx1QkFBa0MsR0FBRyxDQUFDLEVBQUUsQ0FBQztRQUMxRCxPQUFPLENBQUMsR0FBRyxPQUFPLDBDQUEwQyxDQUFDLENBQUM7SUFDaEUsQ0FBQztJQUNELE9BQU8sRUFBRSxDQUFDO0FBQ1osQ0FBQyxDQUFDO0FBRUYsTUFBTSxDQUFDLE1BQU0sbUNBQW1DLEdBQUcsQ0FDakQsT0FBZ0IsRUFDaEIsMkJBQXNDLEVBQzVCLEVBQUU7SUFDWixJQUFJLENBQUMsUUFBUSxDQUFDLE9BQU8sQ0FBQztRQUFFLE9BQU8sQ0FBQywwQ0FBMEMsQ0FBQyxDQUFDO0lBQzVFLE1BQU0sTUFBTSxHQUFhLEVBQUUsQ0FBQztJQUM1QixJQUFJLE9BQU8sQ0FBQyxhQUFhLEtBQUssQ0FBQztRQUFFLE1BQU0sQ0FBQyxJQUFJLENBQUMsZ0RBQWdELENBQUMsQ0FBQztJQUMvRixJQUFJLENBQUMsTUFBTSxDQUFDLGFBQWEsQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLElBQUssT0FBTyxDQUFDLFFBQW1CLEdBQUcsQ0FBQyxFQUFFLENBQUM7UUFDaEYsTUFBTSxDQUFDLElBQUksQ0FBQyw0REFBNEQsQ0FBQyxDQUFDO0lBQzVFLENBQUM7SUFDRCxJQUFJLENBQUMsTUFBTSxDQUFDLGFBQWEsQ0FBQyxPQUFPLENBQUMsU0FBUyxDQUFDLElBQUssT0FBTyxDQUFDLFNBQW9CLEdBQUcsQ0FBQyxFQUFFLENBQUM7UUFDbEYsTUFBTSxDQUFDLElBQUksQ0FBQyxpRUFBaUUsQ0FBQyxDQUFDO0lBQ2pGLENBQUM7SUFDRCxJQUFJLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxPQUFPLENBQUMsYUFBYSxDQUFDO1dBQ3BDLE9BQU8sQ0FBQyxhQUFhLENBQUMsTUFBTSxLQUFLLENBQUM7V0FDbEMsT0FBTyxDQUFDLGFBQWEsQ0FBQyxNQUFNLEdBQUcsR0FBRyxFQUFFLENBQUM7UUFDeEMsTUFBTSxDQUFDLElBQUksQ0FBQyx3RUFBd0UsQ0FBQyxDQUFDO1FBQ3RGLE9BQU8sTUFBTSxDQUFDO0lBQ2hCLENBQUM7SUFDRCxNQUFNLFVBQVUsR0FBYSxFQUFFLENBQUM7SUFDaEMsTUFBTSxzQkFBc0IsR0FBRyxJQUFJLEdBQUcsRUFBNEMsQ0FBQztJQUNuRixNQUFNLGlDQUFpQyxHQUFHLENBQ3hDLFlBQXFCLEVBQ3JCLG9CQUE0QixFQUM1QixPQUFlLEVBQ1QsRUFBRTtRQUNSLE1BQU0sZUFBZSxHQUFHLHVDQUF1QyxDQUM3RCxZQUFZLEVBQ1osb0JBQW9CLEVBQ3BCLE9BQU8sQ0FDUixDQUFDO1FBQ0YsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLGVBQWUsQ0FBQyxDQUFDO1FBQ2hDLElBQUksZUFBZSxDQUFDLE1BQU0sR0FBRyxDQUFDO1lBQUUsT0FBTztRQUN2QyxNQUFNLFNBQVMsR0FBRyxZQUFnRCxDQUFDO1FBQ25FLE1BQU0saUJBQWlCLEdBQUcsc0JBQXNCLENBQUMsR0FBRyxDQUFDLFNBQVMsQ0FBQyxVQUFVLENBQUMsQ0FBQztRQUMzRSxJQUNFLGlCQUFpQjtlQUNkLENBQUMscUNBQXFDLENBQUMsaUJBQWlCLEVBQUUsU0FBUyxDQUFDLEVBQ3ZFLENBQUM7WUFDRCxNQUFNLENBQUMsSUFBSSxDQUNULEdBQUcsT0FBTyxnRkFBZ0YsQ0FDM0YsQ0FBQztZQUNGLE9BQU87UUFDVCxDQUFDO1FBQ0Qsc0JBQXNCLENBQUMsR0FBRyxDQUFDLFNBQVMsQ0FBQyxVQUFVLEVBQUUsU0FBUyxDQUFDLENBQUM7SUFDOUQsQ0FBQyxDQUFDO0lBQ0YsS0FBSyxNQUFNLENBQUMsS0FBSyxFQUFFLFNBQVMsQ0FBQyxJQUFJLE9BQU8sQ0FBQyxhQUFhLENBQUMsT0FBTyxFQUFFLEVBQUUsQ0FBQztRQUNqRSxNQUFNLElBQUksR0FBRyx3Q0FBd0MsS0FBSyxHQUFHLENBQUM7UUFDOUQsSUFBSSxDQUFDLFFBQVEsQ0FBQyxTQUFTLENBQUMsSUFBSSxDQUFDLGtCQUFrQixDQUFDLFNBQVMsQ0FBQyxTQUFTLENBQUMsRUFBRSxDQUFDO1lBQ3JFLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxJQUFJLDhCQUE4QixDQUFDLENBQUM7WUFDbkQsU0FBUztRQUNYLENBQUM7UUFDRCxVQUFVLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxTQUFTLENBQUMsQ0FBQztRQUNyQyxpQ0FBaUMsQ0FDL0IsU0FBUyxDQUFDLGVBQWUsRUFDekIsU0FBUyxDQUFDLFNBQVMsRUFDbkIsR0FBRyxJQUFJLGtCQUFrQixDQUMxQixDQUFDO1FBQ0YsSUFBSSxTQUFTLENBQUMsZUFBZSxLQUFLLFNBQVMsRUFBRSxDQUFDO1lBQzVDLGlDQUFpQyxDQUMvQixTQUFTLENBQUMsZUFBZSxFQUN6QixTQUFTLENBQUMsU0FBUyxFQUNuQixHQUFHLElBQUksa0JBQWtCLENBQzFCLENBQUM7UUFDSixDQUFDO1FBQ0QsSUFBSSxTQUFTLENBQUMsd0JBQXdCLEtBQUssU0FBUyxFQUFFLENBQUM7WUFDckQsSUFBSSxDQUFDLFFBQVEsQ0FBQyxTQUFTLENBQUMsd0JBQXdCLENBQUM7bUJBQzVDLENBQUMsTUFBTSxDQUFDLGFBQWEsQ0FBQyxTQUFTLENBQUMsd0JBQXdCLENBQUMsYUFBYSxDQUFDO21CQUN0RSxTQUFTLENBQUMsd0JBQXdCLENBQUMsYUFBd0IsR0FBRyxDQUFDLEVBQUUsQ0FBQztnQkFDdEUsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLElBQUksOERBQThELENBQUMsQ0FBQztZQUNyRixDQUFDO2lCQUFNLENBQUM7Z0JBQ04saUNBQWlDLENBQy9CLFNBQVMsQ0FBQyx3QkFBd0IsQ0FBQyxRQUFRLEVBQzNDLFNBQVMsQ0FBQyxTQUFTLEVBQ25CLEdBQUcsSUFBSSxvQ0FBb0MsQ0FDNUMsQ0FBQztnQkFDRixJQUNFLE1BQU0sQ0FBQyxhQUFhLENBQUMsU0FBUyxDQUFDLFNBQVMsQ0FBQzt1QkFDckMsU0FBUyxDQUFDLHdCQUF3QixDQUFDLGFBQXdCOzBCQUMxRCxTQUFTLENBQUMsU0FBb0IsRUFDbkMsQ0FBQztvQkFDRCxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsSUFBSSw0REFBNEQsQ0FBQyxDQUFDO2dCQUNuRixDQUFDO1lBQ0gsQ0FBQztRQUNILENBQUM7UUFDRCxJQUFJLENBQUM7WUFDSCxTQUFTO1lBQ1QsVUFBVTtZQUNWLFNBQVM7WUFDVCxTQUFTO1lBQ1QsUUFBUTtTQUNULENBQUMsUUFBUSxDQUFDLFNBQVMsQ0FBQyxNQUFnQixDQUFDLEVBQUUsQ0FBQztZQUN2QyxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsSUFBSSwyQkFBMkIsQ0FBQyxDQUFDO1FBQ2xELENBQUM7UUFDRCxJQUFJLENBQUMsTUFBTSxDQUFDLGFBQWEsQ0FBQyxTQUFTLENBQUMsU0FBUyxDQUFDLElBQUssU0FBUyxDQUFDLFNBQW9CLEdBQUcsQ0FBQyxFQUFFLENBQUM7WUFDdEYsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLElBQUksMkNBQTJDLENBQUMsQ0FBQztRQUNsRSxDQUFDO1FBQ0QsSUFDRSxTQUFTLENBQUMsTUFBTSxLQUFLLFNBQVM7ZUFDM0IsQ0FBQyxxQ0FBcUMsQ0FDdkMsU0FBUyxDQUFDLGVBQThELEVBQ3hFLFNBQVMsQ0FBQyxlQUE4RCxDQUN6RSxFQUNELENBQUM7WUFDRCxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsSUFBSSw2REFBNkQsQ0FBQyxDQUFDO1FBQ3BGLENBQUM7SUFDSCxDQUFDO0lBQ0QsSUFBSSxJQUFJLEdBQUcsQ0FBQyxVQUFVLENBQUMsQ0FBQyxJQUFJLEtBQUssVUFBVSxDQUFDLE1BQU0sRUFBRSxDQUFDO1FBQ25ELE1BQU0sQ0FBQyxJQUFJLENBQUMscUVBQXFFLENBQUMsQ0FBQztJQUNyRixDQUFDO0lBQ0QsSUFBSSwyQkFBMkIsRUFBRSxDQUFDO1FBQ2hDLE1BQU0sUUFBUSxHQUFHLENBQUMsR0FBRyxJQUFJLEdBQUcsQ0FBQywyQkFBMkIsQ0FBQyxDQUFDLENBQUMsSUFBSSxFQUFFLENBQUM7UUFDbEUsSUFBSSxJQUFJLENBQUMsU0FBUyxDQUFDLENBQUMsR0FBRyxVQUFVLENBQUMsQ0FBQyxJQUFJLEVBQUUsQ0FBQyxLQUFLLElBQUksQ0FBQyxTQUFTLENBQUMsUUFBUSxDQUFDLEVBQUUsQ0FBQztZQUN4RSxNQUFNLENBQUMsSUFBSSxDQUFDLCtFQUErRSxDQUFDLENBQUM7UUFDL0YsQ0FBQztJQUNILENBQUM7SUFDRCxPQUFPLE1BQU0sQ0FBQztBQUNoQixDQUFDLENBQUMifQ==
669
+ export const dockerSecretResourceNameDomain = 'serve.zone/docker-secret-resource/v1';
670
+ export const workloadInitEnvironmentMapPath = '/run/serve.zone/workloadinit-map-v1.json';
671
+ export const workloadRuntimeAssetRoot = '/opt/serve.zone/runtime-assets';
672
+ export const workloadInitExecutablePath = '/opt/serve.zone/runtime-assets/workloadinit/v1/workloadinit';
673
+ export const workloadInitEnvironmentMapMode = 0o444;
674
+ export const workloadRuntimeAssetsReadOnly = true;
675
+ const encodeLowercaseBase32 = (bytesArg) => {
676
+ const alphabet = 'abcdefghijklmnopqrstuvwxyz234567';
677
+ let output = '';
678
+ let accumulator = 0;
679
+ let bitCount = 0;
680
+ for (const byte of bytesArg) {
681
+ accumulator = (accumulator << 8) | byte;
682
+ bitCount += 8;
683
+ while (bitCount >= 5) {
684
+ bitCount -= 5;
685
+ output += alphabet[(accumulator >>> bitCount) & 31];
686
+ }
687
+ accumulator &= (1 << bitCount) - 1;
688
+ }
689
+ if (bitCount > 0)
690
+ output += alphabet[(accumulator << (5 - bitCount)) & 31];
691
+ return output;
692
+ };
693
+ /** Stable resource name; no logical key or value material appears in Docker. */
694
+ export const createDockerSecretResourceName = async (secretVersionIdArg) => {
695
+ if (!isSecretIdentifier(secretVersionIdArg)) {
696
+ throw new Error('secretVersionId must be a canonical identifier');
697
+ }
698
+ const digest = new Uint8Array(await globalThis.crypto.subtle.digest('SHA-256', new TextEncoder().encode(`${dockerSecretResourceNameDomain}\0${secretVersionIdArg}`)));
699
+ const encoded = encodeLowercaseBase32(digest);
700
+ if (encoded.length !== 52)
701
+ throw new Error('unexpected SHA-256 base32 length');
702
+ return `szsv-${encoded}`;
703
+ };
704
+ export const createLauncherSecretSourcePath = (resourceArg) => {
705
+ if (!/^szsv-[a-z2-7]{52}$/.test(resourceArg)) {
706
+ throw new Error('resource must be a canonical serve.zone secret resource name');
707
+ }
708
+ return `/run/serve.zone/secrets/${resourceArg}`;
709
+ };
710
+ /**
711
+ * The nonsecret map is generated only from launcher deliveries. Direct file
712
+ * deliveries mount their version resource at the declared target without the
713
+ * launcher. Runtime assets are mounted read-only; no shell, symlink, or
714
+ * aggregate material file participates in delivery.
715
+ */
716
+ export const createWorkloadInitEnvironmentMap = async (manifestArg) => {
717
+ if (validateResolvedSecretManifest(manifestArg).length > 0
718
+ || !await verifyResolvedSecretManifestDigest(manifestArg)) {
719
+ throw new Error('workload init map requires a valid digest-verified manifest');
720
+ }
721
+ const entries = await Promise.all(manifestArg.entries
722
+ .filter((entryArg) => entryArg.delivery.type === 'launcher-environment')
723
+ .map(async (entryArg) => {
724
+ const resource = await createDockerSecretResourceName(entryArg.secretVersionId);
725
+ return {
726
+ variableName: entryArg.delivery.variableName,
727
+ resource,
728
+ source: createLauncherSecretSourcePath(resource),
729
+ };
730
+ }));
731
+ entries.sort((leftArg, rightArg) => (leftArg.variableName < rightArg.variableName
732
+ ? -1
733
+ : leftArg.variableName > rightArg.variableName ? 1 : 0));
734
+ if (new Set(entries.map((entryArg) => entryArg.variableName)).size !== entries.length
735
+ || new Set(entries.map((entryArg) => entryArg.resource)).size !== entries.length
736
+ || new Set(entries.map((entryArg) => entryArg.source)).size !== entries.length) {
737
+ throw new Error('workload init map entries must have unique variable, resource, and source fields');
738
+ }
739
+ return {
740
+ schemaVersion: 1,
741
+ manifestId: manifestArg.id,
742
+ manifestDigest: manifestArg.digest,
743
+ entries,
744
+ };
745
+ };
746
+ export const verifyWorkloadInitEnvironmentMap = async (mapArg, manifestArg) => {
747
+ if (!isRecord(mapArg)
748
+ || !hasExactKeys(mapArg, ['schemaVersion', 'manifestId', 'manifestDigest', 'entries'])) {
749
+ return false;
750
+ }
751
+ try {
752
+ const expected = await createWorkloadInitEnvironmentMap(manifestArg);
753
+ return JSON.stringify(mapArg) === JSON.stringify(expected);
754
+ }
755
+ catch {
756
+ return false;
757
+ }
758
+ };
759
+ export const createWorkloadInitWrappedInvocation = (originalArgvArg) => {
760
+ if (!Array.isArray(originalArgvArg)
761
+ || originalArgvArg.length === 0
762
+ || originalArgvArg.some((argumentArg) => typeof argumentArg !== 'string'
763
+ || argumentArg.length === 0
764
+ || argumentArg.includes('\0'))) {
765
+ throw new Error('original argv must be a non-empty canonical argument vector');
766
+ }
767
+ return {
768
+ command: [workloadInitExecutablePath],
769
+ args: ['run', '--map', workloadInitEnvironmentMapPath, '--', ...originalArgvArg],
770
+ };
771
+ };
772
+ export const secretRecipientLimits = Object.freeze({
773
+ maximumRecipients: 64,
774
+ });
775
+ const rawX25519PublicKeyRegex = /^[A-Za-z0-9_-]{42}[AEIMQUYcgkosw048]$/;
776
+ export const validateSecretRecipientMetadata = (recipientArg) => {
777
+ if (!isRecord(recipientArg))
778
+ return ['secret recipient must be an object'];
779
+ const lifecycleState = recipientArg.lifecycleState;
780
+ const requiredKeys = lifecycleState === 'active'
781
+ ? ['schemaVersion', 'recipientKeyId', 'publicKey', 'generation', 'activatedAt', 'lifecycleState']
782
+ : lifecycleState === 'retiring'
783
+ ? ['schemaVersion', 'recipientKeyId', 'publicKey', 'generation', 'activatedAt', 'lifecycleState', 'acceptUntil']
784
+ : lifecycleState === 'revoked'
785
+ ? ['schemaVersion', 'recipientKeyId', 'publicKey', 'generation', 'activatedAt', 'lifecycleState', 'revokedAt']
786
+ : [];
787
+ if (requiredKeys.length === 0 || !hasExactKeys(recipientArg, requiredKeys)) {
788
+ return ['secret recipient must use its exact lifecycle schema'];
789
+ }
790
+ const errors = [];
791
+ if (recipientArg.schemaVersion !== 1)
792
+ errors.push('secret recipient schemaVersion must be 1');
793
+ if (!isSecretIdentifier(recipientArg.recipientKeyId)) {
794
+ errors.push('secret recipient key id must be canonical');
795
+ }
796
+ if (typeof recipientArg.publicKey !== 'string'
797
+ || !rawX25519PublicKeyRegex.test(recipientArg.publicKey)) {
798
+ errors.push('secret recipient public key must be canonical base64url raw X25519 material');
799
+ }
800
+ for (const field of ['generation', 'activatedAt']) {
801
+ if (!Number.isSafeInteger(recipientArg[field]) || recipientArg[field] < 1) {
802
+ errors.push(`secret recipient ${field} must be a positive integer`);
803
+ }
804
+ }
805
+ if (lifecycleState === 'retiring'
806
+ && (!Number.isSafeInteger(recipientArg.acceptUntil)
807
+ || recipientArg.acceptUntil <= recipientArg.activatedAt)) {
808
+ errors.push('retiring secret recipient acceptUntil must follow activation');
809
+ }
810
+ if (lifecycleState === 'revoked'
811
+ && (!Number.isSafeInteger(recipientArg.revokedAt)
812
+ || recipientArg.revokedAt < recipientArg.activatedAt)) {
813
+ errors.push('revoked secret recipient revokedAt must not precede activation');
814
+ }
815
+ return errors;
816
+ };
817
+ export const validateSecretRecipientSet = (recipientsArg) => {
818
+ if (!Array.isArray(recipientsArg)
819
+ || recipientsArg.length === 0
820
+ || recipientsArg.length > secretRecipientLimits.maximumRecipients) {
821
+ return [
822
+ `secret recipient set must contain between 1 and ${secretRecipientLimits.maximumRecipients} entries`,
823
+ ];
824
+ }
825
+ const errors = recipientsArg.flatMap((recipientArg, indexArg) => (validateSecretRecipientMetadata(recipientArg)
826
+ .map((errorArg) => `recipients[${indexArg}].${errorArg}`)));
827
+ const recipients = recipientsArg.filter(isRecord);
828
+ if (recipients.filter((recipientArg) => recipientArg.lifecycleState === 'active').length !== 1) {
829
+ errors.push('secret recipient set must contain exactly one active recipient');
830
+ }
831
+ const keyIds = recipients.map((recipientArg) => recipientArg.recipientKeyId);
832
+ const generations = recipients.map((recipientArg) => recipientArg.generation);
833
+ if (new Set(keyIds).size !== keyIds.length)
834
+ errors.push('secret recipient key ids must be unique');
835
+ if (new Set(generations).size !== generations.length) {
836
+ errors.push('secret recipient generations must be unique');
837
+ }
838
+ const activeRecipient = recipients.find((recipientArg) => recipientArg.lifecycleState === 'active');
839
+ const numericGenerations = generations.filter((generationArg) => (Number.isSafeInteger(generationArg)));
840
+ if (activeRecipient
841
+ && Number.isSafeInteger(activeRecipient.generation)
842
+ && numericGenerations.length > 0
843
+ && activeRecipient.generation !== Math.max(...numericGenerations)) {
844
+ errors.push('the active secret recipient must have the greatest generation');
845
+ }
846
+ return errors;
847
+ };
848
+ /** New envelopes target only active recipients. */
849
+ export const canIssueNewSecretEnvelope = (recipientArg) => recipientArg.lifecycleState === 'active';
850
+ export const validateSecretValueInputForRecipient = async (valueInputArg, recipientArg, expectedContextArg) => {
851
+ const errors = validateSecretValueInput(valueInputArg);
852
+ if (errors.length > 0 || !isRecord(valueInputArg) || valueInputArg.mode !== 'sealed') {
853
+ return errors;
854
+ }
855
+ if (!canIssueNewSecretEnvelope(recipientArg)) {
856
+ errors.push('new sealed inputs require the active ingress recipient');
857
+ }
858
+ try {
859
+ const envelope = plugins.smartcrypto.parseX25519Envelope(valueInputArg.envelope);
860
+ if (envelope.recipientKeyId !== recipientArg.recipientKeyId) {
861
+ errors.push('sealed input recipient does not match the active ingress recipient');
862
+ }
863
+ if (!await verifySecretEnvelopeContext(envelope, expectedContextArg)) {
864
+ errors.push('sealed input context does not match the request');
865
+ }
866
+ }
867
+ catch {
868
+ // validateSecretValueInput already reports malformed envelopes.
869
+ }
870
+ return errors;
871
+ };
872
+ /** Retiring recipients open only already-issued envelopes before their deadline. */
873
+ export const canOpenIssuedSecretEnvelope = (recipientArg, issuedAtArg, nowArg) => Number.isSafeInteger(issuedAtArg)
874
+ && Number.isSafeInteger(nowArg)
875
+ && issuedAtArg >= recipientArg.activatedAt
876
+ && issuedAtArg <= nowArg
877
+ && (recipientArg.lifecycleState === 'active'
878
+ || (recipientArg.lifecycleState === 'retiring'
879
+ && issuedAtArg < recipientArg.acceptUntil
880
+ && nowArg < recipientArg.acceptUntil));
881
+ const canonicalSecretOwner = (ownerArg) => {
882
+ switch (ownerArg.kind) {
883
+ case 'service': return { kind: ownerArg.kind, serviceId: ownerArg.serviceId };
884
+ case 'secret-set': return { kind: ownerArg.kind, secretSetId: ownerArg.secretSetId };
885
+ case 'platform-provider': return {
886
+ kind: ownerArg.kind,
887
+ providerConfigId: ownerArg.providerConfigId,
888
+ };
889
+ case 'system': return { kind: ownerArg.kind, systemId: ownerArg.systemId };
890
+ }
891
+ };
892
+ const canonicalSecretDelivery = (deliveryArg) => (deliveryArg.type === 'launcher-environment'
893
+ ? {
894
+ type: deliveryArg.type,
895
+ variableName: deliveryArg.variableName,
896
+ uid: deliveryArg.uid,
897
+ gid: deliveryArg.gid,
898
+ mode: deliveryArg.mode,
899
+ }
900
+ : {
901
+ type: deliveryArg.type,
902
+ targetPath: deliveryArg.targetPath,
903
+ uid: deliveryArg.uid,
904
+ gid: deliveryArg.gid,
905
+ mode: deliveryArg.mode,
906
+ });
907
+ const contextBytes = (valueArg) => (new TextEncoder().encode(JSON.stringify(valueArg)));
908
+ export const createSecretCreateEnvelopeContext = (contextArg) => contextBytes({
909
+ schemaVersion: 1,
910
+ purpose: 'serve.zone/secret-create',
911
+ mutationId: contextArg.mutationId,
912
+ target: canonicalSecretOwner(contextArg.target),
913
+ key: contextArg.key,
914
+ environment: contextArg.environment,
915
+ delivery: canonicalSecretDelivery(contextArg.delivery),
916
+ expectedTargetSecretsRevision: contextArg.expectedTargetSecretsRevision,
917
+ });
918
+ export const createSecretRotateEnvelopeContext = (contextArg) => contextBytes({
919
+ schemaVersion: 1,
920
+ purpose: 'serve.zone/secret-rotate',
921
+ mutationId: contextArg.mutationId,
922
+ secretId: contextArg.secretId,
923
+ expectedSecretRevision: contextArg.expectedSecretRevision,
924
+ expectedActiveVersionId: contextArg.expectedActiveVersionId,
925
+ expectedTargetSecretsRevision: contextArg.expectedTargetSecretsRevision,
926
+ });
927
+ export const createAppStoreInstallSecretEnvelopeContext = (contextArg) => contextBytes({
928
+ schemaVersion: 1,
929
+ purpose: 'serve.zone/app-install-secret',
930
+ mutationId: contextArg.mutationId,
931
+ appId: contextArg.appId,
932
+ appVersion: contextArg.appVersion,
933
+ serviceId: contextArg.serviceId,
934
+ key: contextArg.key,
935
+ delivery: canonicalSecretDelivery(contextArg.delivery),
936
+ generation: contextArg.generation
937
+ ? { encoding: contextArg.generation.encoding, bytes: contextArg.generation.bytes }
938
+ : null,
939
+ });
940
+ export const createResolvedSecretMaterialEnvelopeContext = (contextArg) => contextBytes({
941
+ schemaVersion: 1,
942
+ purpose: 'serve.zone/resolved-secret-material',
943
+ recipientKeyId: contextArg.recipientKeyId,
944
+ organizationId: contextArg.organizationId,
945
+ clusterId: contextArg.clusterId,
946
+ serviceId: contextArg.serviceId,
947
+ imageRolloutId: contextArg.imageRolloutId,
948
+ imageRolloutGeneration: contextArg.imageRolloutGeneration,
949
+ requestedImageDigest: contextArg.requestedImageDigest,
950
+ secretRolloutId: contextArg.secretRolloutId,
951
+ secretRolloutGeneration: contextArg.secretRolloutGeneration,
952
+ manifestId: contextArg.manifestId,
953
+ manifestDigest: contextArg.manifestDigest,
954
+ secretId: contextArg.secretId,
955
+ secretVersionId: contextArg.secretVersionId,
956
+ });
957
+ export const createSecretRecipientEnrollmentChallengeContext = (contextArg) => contextBytes({
958
+ schemaVersion: 1,
959
+ purpose: 'serve.zone/secret-recipient-enrollment-challenge',
960
+ enrollmentId: contextArg.enrollmentId,
961
+ clusterId: contextArg.clusterId,
962
+ recipientKeyId: contextArg.recipientKeyId,
963
+ publicKey: contextArg.publicKey,
964
+ generation: contextArg.generation,
965
+ expiresAt: contextArg.expiresAt,
966
+ });
967
+ //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2VjcmV0LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vdHMvZGF0YS9zZWNyZXQudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxLQUFLLE9BQU8sTUFBTSxlQUFlLENBQUM7QUFFekMsT0FBTyxFQUFFLDRCQUE0QixFQUFFLE1BQU0sY0FBYyxDQUFDO0FBZ0I1RCxnRkFBZ0Y7QUFDaEYsTUFBTSxDQUFDLE1BQU0sK0JBQStCLEdBQUcsQ0FDN0MsaUJBQStDLEVBQy9DLCtCQUF3QyxFQUMvQixFQUFFLENBQUMsaUJBQWlCLEtBQUssUUFBUTtPQUN2QyxDQUFDLGlCQUFpQixLQUFLLFNBQVMsSUFBSSwrQkFBK0IsQ0FBQyxDQUFDO0FBaUsxRSxNQUFNLENBQUMsTUFBTSxpQkFBaUIsR0FBRyxNQUFNLENBQUMsTUFBTSxDQUFDO0lBQzdDLFlBQVksRUFBRSxHQUFHLEdBQUcsSUFBSTtJQUN4QixxQkFBcUIsRUFBRSxFQUFFO0lBQ3pCLHFCQUFxQixFQUFFLEVBQUU7Q0FDMUIsQ0FBQyxDQUFDO0FBaUhILE1BQU0sQ0FBQyxNQUFNLHFDQUFxQyxHQUFHLENBQ25ELE9BQXFELEVBQ3JELFFBQXNELEVBQzdDLEVBQUUsQ0FBQyxDQUNaLE9BQU8sQ0FBQyxPQUFPLENBQUM7T0FDYixPQUFPLENBQUMsUUFBUSxDQUFDO09BQ2pCLE9BQU8sRUFBRSxVQUFVLEtBQUssUUFBUSxFQUFFLFVBQVU7T0FDNUMsT0FBTyxFQUFFLGNBQWMsS0FBSyxRQUFRLEVBQUUsY0FBYztPQUNwRCxPQUFPLEVBQUUsU0FBUyxLQUFLLFFBQVEsRUFBRSxTQUFTO09BQzFDLE9BQU8sRUFBRSxjQUFjLEtBQUssUUFBUSxFQUFFLGNBQWM7T0FDcEQsT0FBTyxFQUFFLHNCQUFzQixLQUFLLFFBQVEsRUFBRSxzQkFBc0I7T0FDcEUsT0FBTyxFQUFFLG9CQUFvQixLQUFLLFFBQVEsRUFBRSxvQkFBb0I7T0FDaEUsT0FBTyxFQUFFLGdCQUFnQixLQUFLLFFBQVEsRUFBRSxnQkFBZ0I7T0FDeEQsT0FBTyxFQUFFLGVBQWUsS0FBSyxRQUFRLEVBQUUsZUFBZTtPQUN0RCxPQUFPLEVBQUUsdUJBQXVCLEtBQUssUUFBUSxFQUFFLHVCQUF1QixDQUMxRSxDQUFDO0FBRUYsTUFBTSxDQUFDLE1BQU0seUNBQXlDLEdBQUcsQ0FDdkQsUUFBdUMsRUFDdkMsWUFBOEMsRUFDOUMsTUFBYyxFQUNMLEVBQUUsQ0FBQyxDQUNaLHFDQUFxQyxDQUFDLFFBQVEsQ0FBQyxlQUFlLEVBQUUsWUFBWSxDQUFDO09BQzFFLHFDQUFxQyxDQUFDLFFBQVEsQ0FBQyxlQUFlLEVBQUUsWUFBWSxDQUFDO09BQzdFLENBQ0QsT0FBTyxDQUFDLFFBQVEsQ0FBQyx3QkFBd0IsQ0FBQztXQUN2QyxNQUFNLEdBQUcsUUFBUSxDQUFDLHdCQUF5QixDQUFDLGFBQWE7V0FDekQscUNBQXFDLENBQ3RDLFFBQVEsQ0FBQyx3QkFBeUIsQ0FBQyxRQUFRLEVBQzNDLFlBQVksQ0FDYixDQUNGLENBQ0YsQ0FBQztBQUVGLE1BQU0scUJBQXFCLEdBQUcscUNBQXFDLENBQUM7QUFDcEUsTUFBTSxzQkFBc0IsR0FBRyxtQ0FBbUMsQ0FBQztBQUNuRSxNQUFNLGNBQWMsR0FBRywwQkFBMEIsQ0FBQztBQUNsRCxNQUFNLGlCQUFpQixHQUFHLHVCQUF1QixDQUFDO0FBQ2xELE1BQU0sMEJBQTBCLEdBQzlCLGlGQUFpRixDQUFDO0FBRXBGLE1BQU0sUUFBUSxHQUFHLENBQUMsUUFBaUIsRUFBdUMsRUFBRSxDQUFDLENBQzNFLE9BQU8sQ0FBQyxRQUFRLENBQUMsSUFBSSxPQUFPLFFBQVEsS0FBSyxRQUFRLElBQUksQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxDQUM5RSxDQUFDO0FBRUYsTUFBTSxZQUFZLEdBQUcsQ0FDbkIsUUFBaUMsRUFDakMsT0FBaUIsRUFDUixFQUFFO0lBQ1gsTUFBTSxNQUFNLEdBQUcsTUFBTSxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsQ0FBQyxJQUFJLEVBQUUsQ0FBQztJQUM1QyxNQUFNLFFBQVEsR0FBRyxDQUFDLEdBQUcsT0FBTyxDQUFDLENBQUMsSUFBSSxFQUFFLENBQUM7SUFDckMsT0FBTyxJQUFJLENBQUMsU0FBUyxDQUFDLE1BQU0sQ0FBQyxLQUFLLElBQUksQ0FBQyxTQUFTLENBQUMsUUFBUSxDQUFDLENBQUM7QUFDN0QsQ0FBQyxDQUFDO0FBRUYsTUFBTSxXQUFXLEdBQUcsQ0FDbEIsUUFBaUMsRUFDakMsT0FBaUIsRUFDUixFQUFFLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsQ0FBQyxLQUFLLENBQUMsQ0FBQyxNQUFNLEVBQUUsRUFBRSxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQztBQUVoRixNQUFNLGtCQUFrQixHQUFHLENBQUMsUUFBaUIsRUFBc0IsRUFBRSxDQUFDLENBQ3BFLE9BQU8sUUFBUSxLQUFLLFFBQVEsSUFBSSxxQkFBcUIsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLENBQ3JFLENBQUM7QUFFRixNQUFNLFdBQVcsR0FBRyxDQUFDLFFBQWlCLEVBQXNCLEVBQUUsQ0FBQyxDQUM3RCxPQUFPLFFBQVEsS0FBSyxRQUFRLElBQUksY0FBYyxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsQ0FDOUQsQ0FBQztBQUVGLE1BQU0sbUJBQW1CLEdBQUcsQ0FBQyxRQUFpQixFQUFzQixFQUFFLENBQUMsQ0FDckUsT0FBTyxRQUFRLEtBQUssUUFBUSxJQUFJLHNCQUFzQixDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsQ0FDdEUsQ0FBQztBQUVGLE1BQU0sQ0FBQyxNQUFNLHdCQUF3QixHQUFHLENBQUMsYUFBc0IsRUFBWSxFQUFFLENBQUMsQ0FDNUUsa0JBQWtCLENBQUMsYUFBYSxDQUFDO0lBQy9CLENBQUMsQ0FBQyxFQUFFO0lBQ0osQ0FBQyxDQUFDLENBQUMsMkNBQTJDLENBQUMsQ0FDbEQsQ0FBQztBQUVGLE1BQU0sQ0FBQyxNQUFNLG1CQUFtQixHQUFHLENBQUMsUUFBaUIsRUFBWSxFQUFFO0lBQ2pFLElBQUksQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDO1FBQUUsT0FBTyxDQUFDLGdDQUFnQyxDQUFDLENBQUM7SUFDbkUsTUFBTSxXQUFXLEdBQUc7UUFDbEIsT0FBTyxFQUFFLENBQUMsTUFBTSxFQUFFLFdBQVcsQ0FBQztRQUM5QixZQUFZLEVBQUUsQ0FBQyxNQUFNLEVBQUUsYUFBYSxDQUFDO1FBQ3JDLG1CQUFtQixFQUFFLENBQUMsTUFBTSxFQUFFLGtCQUFrQixDQUFDO1FBQ2pELE1BQU0sRUFBRSxDQUFDLE1BQU0sRUFBRSxVQUFVLENBQUM7S0FDcEIsQ0FBQztJQUNYLE1BQU0sSUFBSSxHQUFHLFdBQVcsQ0FBQyxRQUFRLENBQUMsSUFBZ0MsQ0FBQyxDQUFDO0lBQ3BFLElBQUksQ0FBQyxJQUFJLElBQUksQ0FBQyxZQUFZLENBQUMsUUFBUSxFQUFFLENBQUMsR0FBRyxJQUFJLENBQUMsQ0FBQyxFQUFFLENBQUM7UUFDaEQsT0FBTyxDQUFDLHVEQUF1RCxDQUFDLENBQUM7SUFDbkUsQ0FBQztJQUNELE1BQU0sT0FBTyxHQUFHLElBQUksQ0FBQyxDQUFDLENBQUMsQ0FBQztJQUN4QixPQUFPLGtCQUFrQixDQUFDLFFBQVEsQ0FBQyxPQUFPLENBQUMsQ0FBQztRQUMxQyxDQUFDLENBQUMsRUFBRTtRQUNKLENBQUMsQ0FBQyxDQUFDLGdCQUFnQixPQUFPLG9CQUFvQixDQUFDLENBQUM7QUFDcEQsQ0FBQyxDQUFDO0FBRUYsTUFBTSxDQUFDLE1BQU0sNkJBQTZCLEdBQUcsQ0FDM0MsU0FBa0MsRUFDbEMsUUFBaUIsRUFDUCxFQUFFO0lBQ1osSUFBSSxRQUFRLEtBQUssVUFBVSxFQUFFLENBQUM7UUFDNUIsT0FBTyxTQUFTLEtBQUssVUFBVTtZQUM3QixDQUFDLENBQUMsRUFBRTtZQUNKLENBQUMsQ0FBQyxDQUFDLG9EQUFvRCxDQUFDLENBQUM7SUFDN0QsQ0FBQztJQUNELElBQUksT0FBTyxRQUFRLEtBQUssUUFBUSxJQUFJLENBQUMsMEJBQTBCLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUM7UUFDL0UsT0FBTyxDQUFDLG9DQUFvQyxDQUFDLENBQUM7SUFDaEQsQ0FBQztJQUNELE9BQU8sUUFBUSxDQUFDLFVBQVUsQ0FBQyxHQUFHLFNBQVMsR0FBRyxDQUFDO1FBQ3pDLENBQUMsQ0FBQyxFQUFFO1FBQ0osQ0FBQyxDQUFDLENBQUMsc0RBQXNELENBQUMsQ0FBQztBQUMvRCxDQUFDLENBQUM7QUFFRixNQUFNLENBQUMsTUFBTSxzQkFBc0IsR0FBRyxDQUFDLFdBQW9CLEVBQVksRUFBRTtJQUN2RSxJQUFJLENBQUMsUUFBUSxDQUFDLFdBQVcsQ0FBQztRQUFFLE9BQU8sQ0FBQyw0QkFBNEIsQ0FBQyxDQUFDO0lBQ2xFLE1BQU0sVUFBVSxHQUFHLFdBQVcsQ0FBQyxJQUFJLEtBQUssc0JBQXNCLENBQUM7SUFDL0QsSUFBSSxDQUFDLFVBQVUsSUFBSSxXQUFXLENBQUMsSUFBSSxLQUFLLE1BQU0sRUFBRSxDQUFDO1FBQy9DLE9BQU8sQ0FBQyxvREFBb0QsQ0FBQyxDQUFDO0lBQ2hFLENBQUM7SUFDRCxNQUFNLFlBQVksR0FBRyxVQUFVO1FBQzdCLENBQUMsQ0FBQyxDQUFDLE1BQU0sRUFBRSxjQUFjLEVBQUUsS0FBSyxFQUFFLEtBQUssRUFBRSxNQUFNLENBQUM7UUFDaEQsQ0FBQyxDQUFDLENBQUMsTUFBTSxFQUFFLFlBQVksRUFBRSxLQUFLLEVBQUUsS0FBSyxFQUFFLE1BQU0sQ0FBQyxDQUFDO0lBQ2pELElBQUksQ0FBQyxZQUFZLENBQUMsV0FBVyxFQUFFLFlBQVksQ0FBQyxFQUFFLENBQUM7UUFDN0MsT0FBTyxDQUFDLG9DQUFvQyxDQUFDLENBQUM7SUFDaEQsQ0FBQztJQUNELE1BQU0sTUFBTSxHQUFhLEVBQUUsQ0FBQztJQUM1QixJQUFJLFVBQVUsSUFBSSxDQUFDLFdBQVcsQ0FBQyxXQUFXLENBQUMsWUFBWSxDQUFDLEVBQUUsQ0FBQztRQUN6RCxNQUFNLENBQUMsSUFBSSxDQUFDLG9FQUFvRSxDQUFDLENBQUM7SUFDcEYsQ0FBQztJQUNELElBQUksQ0FBQyxVQUFVLElBQUksQ0FBQyxPQUFPLFdBQVcsQ0FBQyxVQUFVLEtBQUssUUFBUTtXQUN6RCw0QkFBNEIsQ0FBQyxXQUFXLENBQUMsVUFBVSxDQUFDLEtBQUssV0FBVyxDQUFDLFVBQVU7V0FDL0UsQ0FBQyxvREFBb0QsQ0FBQyxJQUFJLENBQUMsV0FBVyxDQUFDLFVBQVUsQ0FBQyxDQUFDLEVBQUUsQ0FBQztRQUN6RixNQUFNLENBQUMsSUFBSSxDQUFDLHNFQUFzRSxDQUFDLENBQUM7SUFDdEYsQ0FBQztJQUNELEtBQUssTUFBTSxLQUFLLElBQUksQ0FBQyxLQUFLLEVBQUUsS0FBSyxDQUFVLEVBQUUsQ0FBQztRQUM1QyxNQUFNLEtBQUssR0FBRyxXQUFXLENBQUMsS0FBSyxDQUFDLENBQUM7UUFDakMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxhQUFhLENBQUMsS0FBSyxDQUFDO2VBQzFCLEtBQWdCLEdBQUcsQ0FBQztlQUNwQixLQUFnQixHQUFHLGFBQWEsRUFBRSxDQUFDO1lBQ3ZDLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxVQUFVLENBQUMsQ0FBQyxDQUFDLFVBQVUsQ0FBQyxDQUFDLENBQUMsTUFBTSxhQUFhLEtBQUsscUNBQXFDLENBQUMsQ0FBQztRQUMxRyxDQUFDO0lBQ0gsQ0FBQztJQUNELElBQUksV0FBVyxDQUFDLElBQUksS0FBSyxLQUFLLElBQUksV0FBVyxDQUFDLElBQUksS0FBSyxLQUFLLEVBQUUsQ0FBQztRQUM3RCxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsVUFBVSxDQUFDLENBQUMsQ0FBQyxVQUFVLENBQUMsQ0FBQyxDQUFDLE1BQU0scUNBQXFDLENBQUMsQ0FBQztJQUN4RixDQUFDO0lBQ0QsT0FBTyxNQUFNLENBQUM7QUFDaEIsQ0FBQyxDQUFDO0FBRUYsTUFBTSxDQUFDLE1BQU0sd0JBQXdCLEdBQUcsQ0FBQyxhQUFzQixFQUFZLEVBQUU7SUFDM0UsSUFBSSxDQUFDLFFBQVEsQ0FBQyxhQUFhLENBQUM7UUFBRSxPQUFPLENBQUMsOEJBQThCLENBQUMsQ0FBQztJQUN0RSxJQUFJLGFBQWEsQ0FBQyxJQUFJLEtBQUssUUFBUSxFQUFFLENBQUM7UUFDcEMsSUFBSSxDQUFDLFlBQVksQ0FBQyxhQUFhLEVBQUUsQ0FBQyxNQUFNLEVBQUUsVUFBVSxDQUFDLENBQUMsRUFBRSxDQUFDO1lBQ3ZELE9BQU8sQ0FBQyw2Q0FBNkMsQ0FBQyxDQUFDO1FBQ3pELENBQUM7UUFDRCxJQUFJLENBQUM7WUFDSCxNQUFNLFFBQVEsR0FBRyxPQUFPLENBQUMsV0FBVyxDQUFDLG1CQUFtQixDQUFDLGFBQWEsQ0FBQyxRQUFRLENBQUMsQ0FBQztZQUNqRixPQUFPLFFBQVEsQ0FBQyxVQUFVLENBQUMsTUFBTTttQkFDNUIsSUFBSSxDQUFDLElBQUksQ0FBQyxpQkFBaUIsQ0FBQyxZQUFZLEdBQUcsQ0FBQyxHQUFHLENBQUMsQ0FBQztnQkFDcEQsQ0FBQyxDQUFDLEVBQUU7Z0JBQ0osQ0FBQyxDQUFDLENBQUMsMENBQTBDLGlCQUFpQixDQUFDLFlBQVksUUFBUSxDQUFDLENBQUM7UUFDekYsQ0FBQztRQUFDLE1BQU0sQ0FBQztZQUNQLE9BQU8sQ0FBQyw2REFBNkQsQ0FBQyxDQUFDO1FBQ3pFLENBQUM7SUFDSCxDQUFDO0lBQ0QsSUFBSSxhQUFhLENBQUMsSUFBSSxLQUFLLFdBQVcsRUFBRSxDQUFDO1FBQ3ZDLElBQUksQ0FBQyxZQUFZLENBQUMsYUFBYSxFQUFFLENBQUMsTUFBTSxFQUFFLFVBQVUsRUFBRSxPQUFPLENBQUMsQ0FBQyxFQUFFLENBQUM7WUFDaEUsT0FBTyxDQUFDLGdEQUFnRCxDQUFDLENBQUM7UUFDNUQsQ0FBQztRQUNELE1BQU0sTUFBTSxHQUFhLEVBQUUsQ0FBQztRQUM1QixJQUFJLGFBQWEsQ0FBQyxRQUFRLEtBQUssS0FBSyxJQUFJLGFBQWEsQ0FBQyxRQUFRLEtBQUssV0FBVyxFQUFFLENBQUM7WUFDL0UsTUFBTSxDQUFDLElBQUksQ0FBQyx3REFBd0QsQ0FBQyxDQUFDO1FBQ3hFLENBQUM7UUFDRCxJQUFJLENBQUMsTUFBTSxDQUFDLGFBQWEsQ0FBQyxhQUFhLENBQUMsS0FBSyxDQUFDO2VBQ3hDLGFBQWEsQ0FBQyxLQUFnQixHQUFHLGlCQUFpQixDQUFDLHFCQUFxQjtlQUN4RSxhQUFhLENBQUMsS0FBZ0IsR0FBRyxpQkFBaUIsQ0FBQyxxQkFBcUIsRUFBRSxDQUFDO1lBQy9FLE1BQU0sQ0FBQyxJQUFJLENBQUMsNkRBQTZELENBQUMsQ0FBQztRQUM3RSxDQUFDO1FBQ0QsT0FBTyxNQUFNLENBQUM7SUFDaEIsQ0FBQztJQUNELE9BQU8sQ0FBQyw2Q0FBNkMsQ0FBQyxDQUFDO0FBQ3pELENBQUMsQ0FBQztBQUVGLE1BQU0sZUFBZSxHQUFHLENBQUMsUUFBb0IsRUFBVSxFQUFFO0lBQ3ZELElBQUksTUFBTSxHQUFHLEVBQUUsQ0FBQztJQUNoQixLQUFLLE1BQU0sSUFBSSxJQUFJLFFBQVE7UUFBRSxNQUFNLElBQUksTUFBTSxDQUFDLFlBQVksQ0FBQyxJQUFJLENBQUMsQ0FBQztJQUNqRSxPQUFPLFVBQVUsQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDO1NBQzNCLE9BQU8sQ0FBQyxLQUFLLEVBQUUsR0FBRyxDQUFDO1NBQ25CLE9BQU8sQ0FBQyxLQUFLLEVBQUUsR0FBRyxDQUFDO1NBQ25CLE9BQU8sQ0FBQyxLQUFLLEVBQUUsRUFBRSxDQUFDLENBQUM7QUFDeEIsQ0FBQyxDQUFDO0FBRUYsd0ZBQXdGO0FBQ3hGLE1BQU0sQ0FBQyxNQUFNLDJCQUEyQixHQUFHLEtBQUssRUFDOUMsV0FBb0IsRUFDcEIsVUFBbUIsRUFDRCxFQUFFO0lBQ3BCLElBQUksQ0FBQyxDQUFDLFVBQVUsWUFBWSxVQUFVLENBQUM7UUFBRSxPQUFPLEtBQUssQ0FBQztJQUN0RCxJQUFJLFFBQStDLENBQUM7SUFDcEQsSUFBSSxDQUFDO1FBQ0gsUUFBUSxHQUFHLE9BQU8sQ0FBQyxXQUFXLENBQUMsbUJBQW1CLENBQUMsV0FBVyxDQUFDLENBQUM7SUFDbEUsQ0FBQztJQUFDLE1BQU0sQ0FBQztRQUNQLE9BQU8sS0FBSyxDQUFDO0lBQ2YsQ0FBQztJQUNELE1BQU0sYUFBYSxHQUFHLElBQUksVUFBVSxDQUFDLE1BQU0sVUFBVSxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUN4RSxTQUFTLEVBQ1QsSUFBSSxVQUFVLENBQUMsVUFBVSxDQUFDLENBQzNCLENBQUMsQ0FBQztJQUNILE9BQU8sUUFBUSxDQUFDLGFBQWEsS0FBSyxlQUFlLENBQUMsYUFBYSxDQUFDLENBQUM7QUFDbkUsQ0FBQyxDQUFDO0FBRUYscUZBQXFGO0FBQ3JGLE1BQU0sQ0FBQyxNQUFNLHdCQUF3QixHQUFHLENBQ3RDLGFBQXNCLEVBQ3RCLFdBQTRCLEVBQ2xCLEVBQUU7SUFDWixJQUFJLENBQUMsQ0FBQyxhQUFhLFlBQVksVUFBVSxDQUFDO1FBQUUsT0FBTyxDQUFDLCtCQUErQixDQUFDLENBQUM7SUFDckYsSUFBSSxhQUFhLENBQUMsVUFBVSxHQUFHLGlCQUFpQixDQUFDLFlBQVksRUFBRSxDQUFDO1FBQzlELE9BQU8sQ0FBQyxtQ0FBbUMsaUJBQWlCLENBQUMsWUFBWSxRQUFRLENBQUMsQ0FBQztJQUNyRixDQUFDO0lBQ0QsSUFBSSxXQUFXLENBQUMsSUFBSSxLQUFLLE1BQU07UUFBRSxPQUFPLEVBQUUsQ0FBQztJQUMzQyxJQUFJLENBQUM7UUFDSCxNQUFNLE9BQU8sR0FBRyxJQUFJLFdBQVcsQ0FBQyxPQUFPLEVBQUUsRUFBRSxLQUFLLEVBQUUsSUFBSSxFQUFFLENBQUMsQ0FBQyxNQUFNLENBQUMsYUFBYSxDQUFDLENBQUM7UUFDaEYsT0FBTyxPQUFPLENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQztZQUMzQixDQUFDLENBQUMsQ0FBQywrQ0FBK0MsQ0FBQztZQUNuRCxDQUFDLENBQUMsRUFBRSxDQUFDO0lBQ1QsQ0FBQztJQUFDLE1BQU0sQ0FBQztRQUNQLE9BQU8sQ0FBQyw4Q0FBOEMsQ0FBQyxDQUFDO0lBQzFELENBQUM7QUFDSCxDQUFDLENBQUM7QUFFRjs7OztHQUlHO0FBQ0gsTUFBTSxDQUFDLE1BQU0scUJBQXFCLEdBQUcsQ0FBQyxXQUlyQyxFQUFtQixFQUFFLENBQUMsQ0FDckIsV0FBVyxDQUFDLGdCQUFnQjtPQUN6QixXQUFXLENBQUMsa0JBQWtCO09BQzlCLFdBQVcsQ0FBQyxhQUFhLENBQzdCLENBQUM7QUFFRixNQUFNLENBQUMsTUFBTSxrQ0FBa0MsR0FBRyxDQUNoRCxnQkFBeUIsRUFDZixFQUFFO0lBQ1osSUFBSSxDQUFDLFFBQVEsQ0FBQyxnQkFBZ0IsQ0FBQyxFQUFFLENBQUM7UUFDaEMsT0FBTyxDQUFDLHVDQUF1QyxDQUFDLENBQUM7SUFDbkQsQ0FBQztJQUNELE1BQU0sTUFBTSxHQUFhLEVBQUUsQ0FBQztJQUM1QixJQUFJLENBQUMsWUFBWSxDQUFDLGdCQUFnQixFQUFFO1FBQ2xDLGVBQWU7UUFDZixVQUFVO1FBQ1YsaUJBQWlCO1FBQ2pCLHNCQUFzQjtLQUN2QixDQUFDLEVBQUUsQ0FBQztRQUNILE1BQU0sQ0FBQyxJQUFJLENBQUMsK0NBQStDLENBQUMsQ0FBQztJQUMvRCxDQUFDO0lBQ0QsSUFBSSxnQkFBZ0IsQ0FBQyxhQUFhLEtBQUssQ0FBQyxFQUFFLENBQUM7UUFDekMsTUFBTSxDQUFDLElBQUksQ0FBQyw2Q0FBNkMsQ0FBQyxDQUFDO0lBQzdELENBQUM7SUFDRCxJQUFJLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxnQkFBZ0IsQ0FBQyxvQkFBb0IsQ0FBQyxFQUFFLENBQUM7UUFDMUQsTUFBTSxDQUFDLElBQUksQ0FBQyx1Q0FBdUMsQ0FBQyxDQUFDO1FBQ3JELE9BQU8sTUFBTSxDQUFDO0lBQ2hCLENBQUM7SUFDRCxJQUFJLGdCQUFnQixDQUFDLG9CQUFvQixDQUFDLE1BQU0sR0FBRyxFQUFFLEVBQUUsQ0FBQztRQUN0RCxNQUFNLENBQUMsSUFBSSxDQUFDLHNEQUFzRCxDQUFDLENBQUM7UUFDcEUsT0FBTyxNQUFNLENBQUM7SUFDaEIsQ0FBQztJQUNELElBQUksQ0FBQyxNQUFNLENBQUMsYUFBYSxDQUFDLGdCQUFnQixDQUFDLFFBQVEsQ0FBQztXQUM5QyxnQkFBZ0IsQ0FBQyxRQUFtQixHQUFHLENBQUMsRUFBRSxDQUFDO1FBQy9DLE1BQU0sQ0FBQyxJQUFJLENBQUMsNkRBQTZELENBQUMsQ0FBQztJQUM3RSxDQUFDO0lBQ0QsSUFBSSxDQUFDLE1BQU0sQ0FBQyxhQUFhLENBQUMsZ0JBQWdCLENBQUMsZUFBZSxDQUFDO1dBQ3JELGdCQUFnQixDQUFDLGVBQTBCLEdBQUcsQ0FBQyxFQUFFLENBQUM7UUFDdEQsTUFBTSxDQUFDLElBQUksQ0FBQyxvRUFBb0UsQ0FBQyxDQUFDO0lBQ3BGLENBQUM7SUFDRCxNQUFNLGFBQWEsR0FBYSxFQUFFLENBQUM7SUFDbkMsTUFBTSxrQkFBa0IsR0FBYSxFQUFFLENBQUM7SUFDeEMsS0FBSyxNQUFNLENBQUMsZUFBZSxFQUFFLFNBQVMsQ0FBQyxJQUFJLGdCQUFnQixDQUFDLG9CQUFvQixDQUFDLE9BQU8sRUFBRSxFQUFFLENBQUM7UUFDM0YsSUFBSSxDQUFDLFFBQVEsQ0FBQyxTQUFTLENBQUMsRUFBRSxDQUFDO1lBQ3pCLE1BQU0sQ0FBQyxJQUFJLENBQUMsd0JBQXdCLGVBQWUscUJBQXFCLENBQUMsQ0FBQztZQUMxRSxTQUFTO1FBQ1gsQ0FBQztRQUNELElBQUksQ0FBQyxXQUFXLENBQUMsU0FBUyxFQUFFLENBQUMsSUFBSSxFQUFFLGFBQWEsRUFBRSxhQUFhLEVBQUUsVUFBVSxDQUFDLENBQUMsRUFBRSxDQUFDO1lBQzlFLE1BQU0sQ0FBQyxJQUFJLENBQUMsd0JBQXdCLGVBQWUsK0JBQStCLENBQUMsQ0FBQztRQUN0RixDQUFDO1FBQ0QsSUFBSSxDQUFDLGtCQUFrQixDQUFDLFNBQVMsQ0FBQyxFQUFFLENBQUMsRUFBRSxDQUFDO1lBQ3RDLE1BQU0sQ0FBQyxJQUFJLENBQUMsd0JBQXdCLGVBQWUscUNBQXFDLENBQUMsQ0FBQztRQUM1RixDQUFDO2FBQU0sQ0FBQztZQUNOLGFBQWEsQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLEVBQUUsQ0FBQyxDQUFDO1FBQ25DLENBQUM7UUFDRCxJQUFJLENBQUMsa0JBQWtCLENBQUMsU0FBUyxDQUFDLFdBQVcsQ0FBQyxFQUFFLENBQUM7WUFDL0MsTUFBTSxDQUFDLElBQUksQ0FDVCx3QkFBd0IsZUFBZSw4Q0FBOEMsQ0FDdEYsQ0FBQztRQUNKLENBQUM7UUFDRCxJQUFJLENBQUMsbUJBQW1CLENBQUMsU0FBUyxDQUFDLFdBQVcsQ0FBQyxFQUFFLENBQUM7WUFDaEQsTUFBTSxDQUFDLElBQUksQ0FDVCx3QkFBd0IsZUFBZSwrQ0FBK0MsQ0FDdkYsQ0FBQztRQUNKLENBQUM7UUFDRCxJQUFJLGtCQUFrQixDQUFDLFNBQVMsQ0FBQyxXQUFXLENBQUM7ZUFDeEMsbUJBQW1CLENBQUMsU0FBUyxDQUFDLFdBQVcsQ0FBQyxFQUFFLENBQUM7WUFDaEQsa0JBQWtCLENBQUMsSUFBSSxDQUFDLEdBQUcsU0FBUyxDQUFDLFdBQVcsS0FBSyxTQUFTLENBQUMsV0FBVyxFQUFFLENBQUMsQ0FBQztRQUNoRixDQUFDO1FBQ0QsSUFBSSxTQUFTLENBQUMsUUFBUSxLQUFLLFNBQVM7WUFBRSxTQUFTO1FBQy9DLElBQUksQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLFNBQVMsQ0FBQyxRQUFRLENBQUMsSUFBSSxTQUFTLENBQUMsUUFBUSxDQUFDLE1BQU0sR0FBRyxHQUFHLEVBQUUsQ0FBQztZQUMxRSxNQUFNLENBQUMsSUFBSSxDQUFDLHdCQUF3QixlQUFlLG9DQUFvQyxDQUFDLENBQUM7WUFDekYsU0FBUztRQUNYLENBQUM7UUFDRCxNQUFNLFVBQVUsR0FBYSxFQUFFLENBQUM7UUFDaEMsTUFBTSxVQUFVLEdBQWEsRUFBRSxDQUFDO1FBQ2hDLEtBQUssTUFBTSxDQUFDLFlBQVksRUFBRSxnQkFBZ0IsQ0FBQyxJQUFJLFNBQVMsQ0FBQyxRQUFRLENBQUMsT0FBTyxFQUFFLEVBQUUsQ0FBQztZQUM1RSxJQUFJLENBQUMsUUFBUSxDQUFDLGdCQUFnQixDQUFDLEVBQUUsQ0FBQztnQkFDaEMsTUFBTSxDQUFDLElBQUksQ0FDVCx3QkFBd0IsZUFBZSxjQUFjLFlBQVkscUJBQXFCLENBQ3ZGLENBQUM7Z0JBQ0YsU0FBUztZQUNYLENBQUM7WUFDRCxJQUFJLENBQUMsV0FBVyxDQUFDLGdCQUFnQixFQUFFLENBQUMsV0FBVyxFQUFFLFdBQVcsRUFBRSxVQUFVLENBQUMsQ0FBQyxFQUFFLENBQUM7Z0JBQzNFLE1BQU0sQ0FBQyxJQUFJLENBQ1Qsd0JBQXdCLGVBQWUsY0FBYyxZQUFZLCtCQUErQixDQUNqRyxDQUFDO1lBQ0osQ0FBQztZQUNELElBQUksQ0FBQyxXQUFXLENBQUMsZ0JBQWdCLENBQUMsU0FBUyxDQUFDLEVBQUUsQ0FBQztnQkFDN0MsTUFBTSxDQUFDLElBQUksQ0FDVCx3QkFBd0IsZUFBZSxjQUFjLFlBQVksK0JBQStCLENBQ2pHLENBQUM7WUFDSixDQUFDO2lCQUFNLENBQUM7Z0JBQ04sVUFBVSxDQUFDLElBQUksQ0FBQyxnQkFBZ0IsQ0FBQyxTQUFTLENBQUMsQ0FBQztZQUM5QyxDQUFDO1lBQ0QsTUFBTSxRQUFRLEdBQUcsZ0JBQWdCLENBQUMsU0FBUyxJQUFJLGdCQUFnQixDQUFDLFNBQVMsQ0FBQztZQUMxRSxJQUFJLENBQUMsV0FBVyxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUM7Z0JBQzNCLE1BQU0sQ0FBQyxJQUFJLENBQ1Qsd0JBQXdCLGVBQWUsY0FBYyxZQUFZLCtCQUErQixDQUNqRyxDQUFDO1lBQ0osQ0FBQztpQkFBTSxDQUFDO2dCQUNOLFVBQVUsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLENBQUM7WUFDNUIsQ0FBQztZQUNELElBQUksZ0JBQWdCLENBQUMsUUFBUSxLQUFLLFNBQVMsRUFBRSxDQUFDO2dCQUM1QyxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsc0JBQXNCLENBQUMsZ0JBQWdCLENBQUMsUUFBUSxDQUFDLENBQUMsR0FBRyxDQUNsRSxDQUFDLFFBQVEsRUFBRSxFQUFFLENBQUMsQ0FDWix3QkFBd0IsZUFBZSxjQUFjLFlBQVksS0FBSyxRQUFRLEVBQUUsQ0FDakYsQ0FDRixDQUFDLENBQUM7WUFDTCxDQUFDO1FBQ0gsQ0FBQztRQUNELElBQUksSUFBSSxHQUFHLENBQUMsVUFBVSxDQUFDLENBQUMsSUFBSSxLQUFLLFVBQVUsQ0FBQyxNQUFNLEVBQUUsQ0FBQztZQUNuRCxNQUFNLENBQUMsSUFBSSxDQUFDLHdCQUF3QixlQUFlLGlDQUFpQyxDQUFDLENBQUM7UUFDeEYsQ0FBQztRQUNELElBQUksSUFBSSxHQUFHLENBQUMsVUFBVSxDQUFDLENBQUMsSUFBSSxLQUFLLFVBQVUsQ0FBQyxNQUFNLEVBQUUsQ0FBQztZQUNuRCxNQUFNLENBQUMsSUFBSSxDQUFDLHdCQUF3QixlQUFlLGlDQUFpQyxDQUFDLENBQUM7UUFDeEYsQ0FBQztJQUNILENBQUM7SUFDRCxJQUFJLElBQUksR0FBRyxDQUFDLGFBQWEsQ0FBQyxDQUFDLElBQUksS0FBSyxhQUFhLENBQUMsTUFBTSxFQUFFLENBQUM7UUFDekQsTUFBTSxDQUFDLElBQUksQ0FBQyx5Q0FBeUMsQ0FBQyxDQUFDO0lBQ3pELENBQUM7SUFDRCxJQUFJLElBQUksR0FBRyxDQUFDLGtCQUFrQixDQUFDLENBQUMsSUFBSSxLQUFLLGtCQUFrQixDQUFDLE1BQU0sRUFBRSxDQUFDO1FBQ25FLE1BQU0sQ0FBQyxJQUFJLENBQUMsdURBQXVELENBQUMsQ0FBQztJQUN2RSxDQUFDO0lBQ0QsT0FBTyxNQUFNLENBQUM7QUFDaEIsQ0FBQyxDQUFDO0FBRUYsTUFBTSxDQUFDLE1BQU0sb0NBQW9DLEdBQUcsQ0FDbEQsZ0JBQTZDLEVBQzdDLHdCQUFnQyxFQUNoQyxhQUFtQyxFQUN6QixFQUFFO0lBQ1osTUFBTSxNQUFNLEdBQUcsa0NBQWtDLENBQUMsZ0JBQWdCLENBQUMsQ0FBQztJQUNwRSxNQUFNLGNBQWMsR0FBRyxJQUFJLEdBQUcsQ0FBQyxhQUFhLENBQUMsR0FBRyxDQUFDLENBQUMsWUFBWSxFQUFFLEVBQUUsQ0FBQztRQUNqRSxZQUFZLENBQUMsRUFBRTtRQUNmLFlBQVk7S0FDYixDQUFDLENBQUMsQ0FBQztJQUNKLEtBQUssTUFBTSxVQUFVLElBQUksZ0JBQWdCLENBQUMsb0JBQW9CLElBQUksRUFBRSxFQUFFLENBQUM7UUFDckUsTUFBTSxTQUFTLEdBQUcsY0FBYyxDQUFDLEdBQUcsQ0FBQyxVQUFVLENBQUMsV0FBVyxDQUFDLENBQUM7UUFDN0QsSUFBSSxDQUFDLFNBQVMsRUFBRSxDQUFDO1lBQ2YsTUFBTSxDQUFDLElBQUksQ0FBQyxhQUFhLFVBQVUsQ0FBQyxXQUFXLGlCQUFpQixDQUFDLENBQUM7UUFDcEUsQ0FBQzthQUFNLElBQUksU0FBUyxDQUFDLGNBQWMsS0FBSyx3QkFBd0IsRUFBRSxDQUFDO1lBQ2pFLE1BQU0sQ0FBQyxJQUFJLENBQUMsYUFBYSxVQUFVLENBQUMsV0FBVyxrQ0FBa0MsQ0FBQyxDQUFDO1FBQ3JGLENBQUM7YUFBTSxJQUFJLFNBQVMsQ0FBQyxjQUFjLEtBQUssUUFBUSxFQUFFLENBQUM7WUFDakQsTUFBTSxDQUFDLElBQUksQ0FBQyxhQUFhLFVBQVUsQ0FBQyxXQUFXLGdCQUFnQixDQUFDLENBQUM7UUFDbkUsQ0FBQztJQUNILENBQUM7SUFDRCxPQUFPLE1BQU0sQ0FBQztBQUNoQixDQUFDLENBQUM7QUFFRixNQUFNLENBQUMsTUFBTSx1Q0FBdUMsR0FBRyxDQUNyRCxXQUFvQyxFQUM1QixFQUFFLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQztJQUMxQixhQUFhLEVBQUUsV0FBVyxDQUFDLGFBQWE7SUFDeEMsRUFBRSxFQUFFLFdBQVcsQ0FBQyxFQUFFO0lBQ2xCLGNBQWMsRUFBRSxXQUFXLENBQUMsY0FBYztJQUMxQyxTQUFTLEVBQUUsV0FBVyxDQUFDLFNBQVM7SUFDaEMsU0FBUyxFQUFFLFdBQVcsQ0FBQyxTQUFTO0lBQ2hDLGNBQWMsRUFBRSxXQUFXLENBQUMsY0FBYztJQUMxQyxzQkFBc0IsRUFBRSxXQUFXLENBQUMsc0JBQXNCO0lBQzFELG9CQUFvQixFQUFFLFdBQVcsQ0FBQyxvQkFBb0I7SUFDdEQsZ0JBQWdCLEVBQUUsV0FBVyxDQUFDLGdCQUFnQjtJQUM5QyxlQUFlLEVBQUUsV0FBVyxDQUFDLGVBQWU7SUFDNUMsdUJBQXVCLEVBQUUsV0FBVyxDQUFDLHVCQUF1QjtJQUM1RCxPQUFPLEVBQUUsV0FBVyxDQUFDLE9BQU8sQ0FBQyxHQUFHLENBQUMsQ0FBQyxRQUFRLEVBQUUsRUFBRSxDQUFDLENBQUM7UUFDOUMsUUFBUSxFQUFFLFFBQVEsQ0FBQyxRQUFRO1FBQzNCLGVBQWUsRUFBRSxRQUFRLENBQUMsZUFBZTtRQUN6QyxHQUFHLEVBQUUsUUFBUSxDQUFDLEdBQUc7UUFDakIsV0FBVyxFQUFFLFFBQVEsQ0FBQyxXQUFXO1FBQ2pDLEtBQUssRUFBRSxRQUFRLENBQUMsS0FBSyxDQUFDLElBQUksS0FBSyxTQUFTO1lBQ3RDLENBQUMsQ0FBQztnQkFDRSxJQUFJLEVBQUUsU0FBUztnQkFDZixTQUFTLEVBQUUsUUFBUSxDQUFDLEtBQUssQ0FBQyxTQUFTO2FBQ3BDO1lBQ0gsQ0FBQyxDQUFDO2dCQUNFLElBQUksRUFBRSxZQUFZO2dCQUNsQixXQUFXLEVBQUUsUUFBUSxDQUFDLEtBQUssQ0FBQyxXQUFXO2FBQ3hDO1FBQ0wsUUFBUSxFQUFFLFFBQVEsQ0FBQyxRQUFRLENBQUMsSUFBSSxLQUFLLHNCQUFzQjtZQUN6RCxDQUFDLENBQUM7Z0JBQ0UsSUFBSSxFQUFFLHNCQUFzQjtnQkFDNUIsWUFBWSxFQUFFLFFBQVEsQ0FBQyxRQUFRLENBQUMsWUFBWTtnQkFDNUMsR0FBRyxFQUFFLFFBQVEsQ0FBQyxRQUFRLENBQUMsR0FBRztnQkFDMUIsR0FBRyxFQUFFLFFBQVEsQ0FBQyxRQUFRLENBQUMsR0FBRztnQkFDMUIsSUFBSSxFQUFFLFFBQVEsQ0FBQyxRQUFRLENBQUMsSUFBSTthQUM3QjtZQUNILENBQUMsQ0FBQztnQkFDRSxJQUFJLEVBQUUsTUFBTTtnQkFDWixVQUFVLEVBQUUsUUFBUSxDQUFDLFFBQVEsQ0FBQyxVQUFVO2dCQUN4QyxHQUFHLEVBQUUsUUFBUSxDQUFDLFFBQVEsQ0FBQyxHQUFHO2dCQUMxQixHQUFHLEVBQUUsUUFBUSxDQUFDLFFBQVEsQ0FBQyxHQUFHO2dCQUMxQixJQUFJLEVBQUUsUUFBUSxDQUFDLFFBQVEsQ0FBQyxJQUFJO2FBQzdCO0tBQ04sQ0FBQyxDQUFDO0lBQ0gsU0FBUyxFQUFFLFdBQVcsQ0FBQyxTQUFTO0NBQ2pDLENBQUMsQ0FBQztBQUVILG1GQUFtRjtBQUNuRixNQUFNLENBQUMsTUFBTSxtQ0FBbUMsR0FBRyxLQUFLLEVBQ3RELFdBQW9DLEVBQ1osRUFBRTtJQUMxQixNQUFNLE9BQU8sR0FBRyxJQUFJLFdBQVcsRUFBRSxDQUFDLE1BQU0sQ0FBQyx1Q0FBdUMsQ0FBQyxXQUFXLENBQUMsQ0FBQyxDQUFDO0lBQy9GLE1BQU0sWUFBWSxHQUFHLE1BQU0sVUFBVSxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLFNBQVMsRUFBRSxPQUFPLENBQUMsQ0FBQztJQUMvRSxNQUFNLFNBQVMsR0FBRyxDQUFDLEdBQUcsSUFBSSxVQUFVLENBQUMsWUFBWSxDQUFDLENBQUM7U0FDaEQsR0FBRyxDQUFDLENBQUMsT0FBTyxFQUFFLEVBQUUsQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLEVBQUUsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxDQUFDLEVBQUUsR0FBRyxDQUFDLENBQUM7U0FDdkQsSUFBSSxDQUFDLEVBQUUsQ0FBQyxDQUFDO0lBQ1osT0FBTyxVQUFVLFNBQVMsRUFBbUIsQ0FBQztBQUNoRCxDQUFDLENBQUM7QUFFRixNQUFNLENBQUMsTUFBTSxrQ0FBa0MsR0FBRyxLQUFLLEVBQ3JELFdBQW9DLEVBQ2xCLEVBQUUsQ0FBQyxDQUNyQixXQUFXLENBQUMsTUFBTSxLQUFLLE1BQU0sbUNBQW1DLENBQUMsV0FBVyxDQUFDLENBQzlFLENBQUM7QUFFRixNQUFNLENBQUMsTUFBTSw4QkFBOEIsR0FBRyxDQUM1QyxXQUFvQixFQUNWLEVBQUU7SUFDWixJQUFJLENBQUMsUUFBUSxDQUFDLFdBQVcsQ0FBQztRQUFFLE9BQU8sQ0FBQyxtQ0FBbUMsQ0FBQyxDQUFDO0lBQ3pFLE1BQU0sTUFBTSxHQUFhLEVBQUUsQ0FBQztJQUM1QixJQUFJLENBQUMsWUFBWSxDQUFDLFdBQVcsRUFBRTtRQUM3QixlQUFlO1FBQ2YsSUFBSTtRQUNKLFFBQVE7UUFDUixnQkFBZ0I7UUFDaEIsV0FBVztRQUNYLFdBQVc7UUFDWCxnQkFBZ0I7UUFDaEIsd0JBQXdCO1FBQ3hCLHNCQUFzQjtRQUN0QixrQkFBa0I7UUFDbEIsaUJBQWlCO1FBQ2pCLHlCQUF5QjtRQUN6QixTQUFTO1FBQ1QsV0FBVztLQUNaLENBQUMsRUFBRSxDQUFDO1FBQ0gsTUFBTSxDQUFDLElBQUksQ0FBQywyQ0FBMkMsQ0FBQyxDQUFDO0lBQzNELENBQUM7SUFDRCxJQUFJLFdBQVcsQ0FBQyxhQUFhLEtBQUssQ0FBQztRQUFFLE1BQU0sQ0FBQyxJQUFJLENBQUMseUNBQXlDLENBQUMsQ0FBQztJQUM1RixLQUFLLE1BQU0sS0FBSyxJQUFJO1FBQ2xCLElBQUk7UUFDSixnQkFBZ0I7UUFDaEIsV0FBVztRQUNYLFdBQVc7UUFDWCxnQkFBZ0I7UUFDaEIsaUJBQWlCO0tBQ1QsRUFBRSxDQUFDO1FBQ1gsSUFBSSxDQUFDLGtCQUFrQixDQUFDLFdBQVcsQ0FBQyxLQUFLLENBQUMsQ0FBQyxFQUFFLENBQUM7WUFDNUMsTUFBTSxDQUFDLElBQUksQ0FBQyxtQkFBbUIsS0FBSyxpQ0FBaUMsQ0FBQyxDQUFDO1FBQ3pFLENBQUM7SUFDSCxDQUFDO0lBQ0QsSUFBSSxPQUFPLFdBQVcsQ0FBQyxNQUFNLEtBQUssUUFBUSxJQUFJLENBQUMsaUJBQWlCLENBQUMsSUFBSSxDQUFDLFdBQVcsQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDO1FBQzFGLE1BQU0sQ0FBQyxJQUFJLENBQUMsMERBQTBELENBQUMsQ0FBQztJQUMxRSxDQUFDO0lBQ0QsS0FBSyxNQUFNLEtBQUssSUFBSSxDQUFDLHNCQUFzQixFQUFFLGtCQUFrQixDQUFVLEVBQUUsQ0FBQztRQUMxRSxJQUFJLE9BQU8sV0FBVyxDQUFDLEtBQUssQ0FBQyxLQUFLLFFBQVEsSUFBSSxDQUFDLGlCQUFpQixDQUFDLElBQUksQ0FBQyxXQUFXLENBQUMsS0FBSyxDQUFDLENBQUMsRUFBRSxDQUFDO1lBQzFGLE1BQU0sQ0FBQyxJQUFJLENBQUMsbUJBQW1CLEtBQUssb0NBQW9DLENBQUMsQ0FBQztRQUM1RSxDQUFDO0lBQ0gsQ0FBQztJQUNELElBQUksQ0FBQyxNQUFNLENBQUMsYUFBYSxDQUFDLFdBQVcsQ0FBQyxzQkFBc0IsQ0FBQztXQUN2RCxXQUFXLENBQUMsc0JBQWlDLEdBQUcsQ0FBQyxFQUFFLENBQUM7UUFDeEQsTUFBTSxDQUFDLElBQUksQ0FBQyxxRUFBcUUsQ0FBQyxDQUFDO0lBQ3JGLENBQUM7SUFDRCxJQUFJLENBQUMsTUFBTSxDQUFDLGFBQWEsQ0FBQyxXQUFXLENBQUMsdUJBQXVCLENBQUM7V0FDeEQsV0FBVyxDQUFDLHVCQUFrQyxHQUFHLENBQUMsRUFBRSxDQUFDO1FBQ3pELE1BQU0sQ0FBQyxJQUFJLENBQUMsK0RBQStELENBQUMsQ0FBQztJQUMvRSxDQUFDO0lBQ0QsSUFBSSxDQUFDLE1BQU0sQ0FBQyxhQUFhLENBQUMsV0FBVyxDQUFDLFNBQVMsQ0FBQyxJQUFLLFdBQVcsQ0FBQyxTQUFvQixHQUFHLENBQUMsRUFBRSxDQUFDO1FBQzFGLE1BQU0sQ0FBQyxJQUFJLENBQUMsMERBQTBELENBQUMsQ0FBQztJQUMxRSxDQUFDO0lBQ0QsSUFBSSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsV0FBVyxDQUFDLE9BQU8sQ0FBQyxJQUFJLFdBQVcsQ0FBQyxPQUFPLENBQUMsTUFBTSxHQUFHLEdBQUcsRUFBRSxDQUFDO1FBQzVFLE1BQU0sQ0FBQyxJQUFJLENBQUMsaURBQWlELENBQUMsQ0FBQztRQUMvRCxPQUFPLE1BQU0sQ0FBQztJQUNoQixDQUFDO0lBQ0QsTUFBTSxTQUFTLEdBQWEsRUFBRSxDQUFDO0lBQy9CLE1BQU0sU0FBUyxHQUFhLEVBQUUsQ0FBQztJQUMvQixNQUFNLFVBQVUsR0FBYSxFQUFFLENBQUM7SUFDaEMsTUFBTSwwQkFBMEIsR0FBYSxFQUFFLENBQUM7SUFDaEQsTUFBTSxtQkFBbUIsR0FBYSxFQUFFLENBQUM7SUFDekMsSUFBSSxlQUFtQyxDQUFDO0lBQ3hDLEtBQUssTUFBTSxDQUFDLEtBQUssRUFBRSxTQUFTLENBQUMsSUFBSSxXQUFXLENBQUMsT0FBTyxDQUFDLE9BQU8sRUFBRSxFQUFFLENBQUM7UUFDL0QsSUFBSSxDQUFDLFFBQVEsQ0FBQyxTQUFTLENBQUMsRUFBRSxDQUFDO1lBQ3pCLE1BQU0sQ0FBQyxJQUFJLENBQUMsMkJBQTJCLEtBQUsscUJBQXFCLENBQUMsQ0FBQztZQUNuRSxTQUFTO1FBQ1gsQ0FBQztRQUNELElBQUksQ0FBQyxZQUFZLENBQUMsU0FBUyxFQUFFO1lBQzNCLFVBQVU7WUFDVixpQkFBaUI7WUFDakIsS0FBSztZQUNMLGFBQWE7WUFDYixPQUFPO1lBQ1AsVUFBVTtTQUNYLENBQUMsRUFBRSxDQUFDO1lBQ0gsTUFBTSxDQUFDLElBQUksQ0FBQywyQkFBMkIsS0FBSyw2QkFBNkIsQ0FBQyxDQUFDO1FBQzdFLENBQUM7UUFDRCxJQUFJLENBQUMsa0JBQWtCLENBQUMsU0FBUyxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUM7WUFDNUMsTUFBTSxDQUFDLElBQUksQ0FBQywyQkFBMkIsS0FBSyw4QkFBOEIsQ0FBQyxDQUFDO1FBQzlFLENBQUM7YUFBTSxDQUFDO1lBQ04sU0FBUyxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsUUFBUSxDQUFDLENBQUM7UUFDckMsQ0FBQztRQUNELElBQUksQ0FBQyxrQkFBa0IsQ0FBQyxTQUFTLENBQUMsZUFBZSxDQUFDLEVBQUUsQ0FBQztZQUNuRCxNQUFNLENBQUMsSUFBSSxDQUFDLDJCQUEyQixLQUFLLHFDQUFxQyxDQUFDLENBQUM7UUFDckYsQ0FBQzthQUFNLENBQUM7WUFDTixVQUFVLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxlQUFlLENBQUMsQ0FBQztRQUM3QyxDQUFDO1FBQ0QsSUFBSSxDQUFDLFdBQVcsQ0FBQyxTQUFTLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQztZQUNoQyxNQUFNLENBQUMsSUFBSSxDQUFDLDJCQUEyQixLQUFLLHlCQUF5QixDQUFDLENBQUM7UUFDekUsQ0FBQztRQUNELElBQUksQ0FBQyxtQkFBbUIsQ0FBQyxTQUFTLENBQUMsV0FBVyxDQUFDLEVBQUUsQ0FBQztZQUNoRCxNQUFNLENBQUMsSUFBSSxDQUFDLDJCQUEyQixLQUFLLGlDQUFpQyxDQUFDLENBQUM7UUFDakYsQ0FBQzthQUFNLElBQUksV0FBVyxDQUFDLFNBQVMsQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDO1lBQ3RDLFNBQVMsQ0FBQyxJQUFJLENBQUMsR0FBRyxTQUFTLENBQUMsV0FBVyxLQUFLLFNBQVMsQ0FBQyxHQUFHLEVBQUUsQ0FBQyxDQUFDO1FBQy9ELENBQUM7UUFDRCxJQUFJLENBQUMsUUFBUSxDQUFDLFNBQVMsQ0FBQyxLQUFLLENBQUM7ZUFDekIsQ0FDRCxTQUFTLENBQUMsS0FBSyxDQUFDLElBQUksS0FBSyxTQUFTO21CQUMvQixTQUFTLENBQUMsS0FBSyxDQUFDLElBQUksS0FBSyxZQUFZLENBQ3pDO2VBQ0UsQ0FBQyxZQUFZLENBQ2QsU0FBUyxDQUFDLEtBQUssRUFDZixTQUFTLENBQUMsS0FBSyxDQUFDLElBQUksS0FBSyxTQUFTO2dCQUNoQyxDQUFDLENBQUMsQ0FBQyxNQUFNLEVBQUUsV0FBVyxDQUFDO2dCQUN2QixDQUFDLENBQUMsQ0FBQyxNQUFNLEVBQUUsYUFBYSxDQUFDLENBQzVCO2VBQ0UsQ0FDRCxTQUFTLENBQUMsS0FBSyxDQUFDLElBQUksS0FBSyxTQUFTO21CQUMvQixDQUFDLGtCQUFrQixDQUFDLFNBQVMsQ0FBQyxLQUFLLENBQUMsU0FBUyxDQUFDLENBQ2xEO2VBQ0UsQ0FDRCxTQUFTLENBQUMsS0FBSyxDQUFDLElBQUksS0FBSyxZQUFZO21CQUNsQyxDQUFDLGtCQUFrQixDQUFDLFNBQVMsQ0FBQyxLQUFLLENBQUMsV0FBVyxDQUFDLENBQ3RELEVBQUUsQ0FBQztZQUNGLE1BQU0sQ0FBQyxJQUFJLENBQUMsMkJBQTJCLEtBQUssMkJBQTJCLENBQUMsQ0FBQztRQUMzRSxDQUFDO2FBQU0sSUFDTCxTQUFTLENBQUMsS0FBSyxDQUFDLElBQUksS0FBSyxTQUFTO2VBQy9CLGtCQUFrQixDQUFDLFdBQVcsQ0FBQyxTQUFTLENBQUM7ZUFDekMsU0FBUyxDQUFDLEtBQUssQ0FBQyxTQUFTLEtBQUssV0FBVyxDQUFDLFNBQVMsRUFDdEQsQ0FBQztZQUNELE1BQU0sQ0FBQyxJQUFJLENBQ1QsMkJBQTJCLEtBQUsscURBQXFELENBQ3RGLENBQUM7UUFDSixDQUFDO1FBQ0QsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLHNCQUFzQixDQUFDLFNBQVMsQ0FBQyxRQUFRLENBQUMsQ0FBQyxHQUFHLENBQzNELENBQUMsUUFBUSxFQUFFLEVBQUUsQ0FBQywyQkFBMkIsS0FBSyxLQUFLLFFBQVEsRUFBRSxDQUM5RCxDQUFDLENBQUM7UUFDSCxJQUFJLFFBQVEsQ0FBQyxTQUFTLENBQUMsUUFBUSxDQUFDLEVBQUUsQ0FBQztZQUNqQyxJQUNFLFNBQVMsQ0FBQyxRQUFRLENBQUMsSUFBSSxLQUFLLHNCQUFzQjttQkFDL0MsV0FBVyxDQUFDLFNBQVMsQ0FBQyxRQUFRLENBQUMsWUFBWSxDQUFDLEVBQy9DLENBQUM7Z0JBQ0QsMEJBQTBCLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxRQUFRLENBQUMsWUFBWSxDQUFDLENBQUM7WUFDbkUsQ0FBQztpQkFBTSxJQUNMLFNBQVMsQ0FBQyxRQUFRLENBQUMsSUFBSSxLQUFLLE1BQU07bUJBQy9CLE9BQU8sU0FBUyxDQUFDLFFBQVEsQ0FBQyxVQUFVLEtBQUssUUFBUTttQkFDakQsc0JBQXNCLENBQUMsU0FBUyxDQUFDLFFBQVEsQ0FBQyxDQUFDLE1BQU0sS0FBSyxDQUFDLEVBQzFELENBQUM7Z0JBQ0QsbUJBQW1CLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxRQUFRLENBQUMsVUFBVSxDQUFDLENBQUM7WUFDMUQsQ0FBQztRQUNILENBQUM7UUFDRCxJQUFJLFdBQVcsQ0FBQyxTQUFTLENBQUMsR0FBRyxDQUFDLElBQUksbUJBQW1CLENBQUMsU0FBUyxDQUFDLFdBQVcsQ0FBQyxFQUFFLENBQUM7WUFDN0UsTUFBTSxPQUFPLEdBQUcsR0FBRyxTQUFTLENBQUMsV0FBVyxLQUFLLFNBQVMsQ0FBQyxHQUFHLEVBQUUsQ0FBQztZQUM3RCxJQUFJLGVBQWUsS0FBSyxTQUFTLElBQUksT0FBTyxJQUFJLGVBQWUsRUFBRSxDQUFDO2dCQUNoRSxNQUFNLENBQUMsSUFBSSxDQUFDLHdFQUF3RSxDQUFDLENBQUM7WUFDeEYsQ0FBQztZQUNELGVBQWUsR0FBRyxPQUFPLENBQUM7UUFDNUIsQ0FBQztJQUNILENBQUM7SUFDRCxJQUFJLElBQUksR0FBRyxDQUFDLFNBQVMsQ0FBQyxDQUFDLElBQUksS0FBSyxTQUFTLENBQUMsTUFBTSxFQUFFLENBQUM7UUFDakQsTUFBTSxDQUFDLElBQUksQ0FBQywyREFBMkQsQ0FBQyxDQUFDO0lBQzNFLENBQUM7SUFDRCxJQUFJLElBQUksR0FBRyxDQUFDLFNBQVMsQ0FBQyxDQUFDLElBQUksS0FBSyxTQUFTLENBQUMsTUFBTSxFQUFFLENBQUM7UUFDakQsTUFBTSxDQUFDLElBQUksQ0FBQywwREFBMEQsQ0FBQyxDQUFDO0lBQzFFLENBQUM7SUFDRCxJQUFJLElBQUksR0FBRyxDQUFDLFVBQVUsQ0FBQyxDQUFDLElBQUksS0FBSyxVQUFVLENBQUMsTUFBTSxFQUFFLENBQUM7UUFDbkQsTUFBTSxDQUFDLElBQUksQ0FBQyxtREFBbUQsQ0FBQyxDQUFDO0lBQ25FLENBQUM7SUFDRCxJQUFJLElBQUksR0FBRyxDQUFDLDBCQUEwQixDQUFDLENBQUMsSUFBSSxLQUFLLDBCQUEwQixDQUFDLE1BQU0sRUFBRSxDQUFDO1FBQ25GLE1BQU0sQ0FBQyxJQUFJLENBQUMsc0VBQXNFLENBQUMsQ0FBQztJQUN0RixDQUFDO0lBQ0QsSUFBSSxJQUFJLEdBQUcsQ0FBQyxtQkFBbUIsQ0FBQyxDQUFDLElBQUksS0FBSyxtQkFBbUIsQ0FBQyxNQUFNLEVBQUUsQ0FBQztRQUNyRSxNQUFNLENBQUMsSUFBSSxDQUFDLCtEQUErRCxDQUFDLENBQUM7SUFDL0UsQ0FBQztJQUNELE9BQU8sTUFBTSxDQUFDO0FBQ2hCLENBQUMsQ0FBQztBQUVGLE1BQU0sdUNBQXVDLEdBQUcsQ0FDOUMsWUFBcUIsRUFDckIsb0JBQTRCLEVBQzVCLE9BQWUsRUFDTCxFQUFFO0lBQ1osSUFBSSxDQUFDLFFBQVEsQ0FBQyxZQUFZLENBQUM7V0FDdEIsQ0FBQyxZQUFZLENBQUMsWUFBWSxFQUFFO1lBQzdCLFlBQVk7WUFDWixnQkFBZ0I7WUFDaEIsV0FBVztZQUNYLGdCQUFnQjtZQUNoQix3QkFBd0I7WUFDeEIsc0JBQXNCO1lBQ3RCLGtCQUFrQjtZQUNsQixpQkFBaUI7WUFDakIseUJBQXlCO1NBQzFCLENBQUM7V0FDQyxDQUFDLGtCQUFrQixDQUFDLFlBQVksQ0FBQyxVQUFVLENBQUM7V0FDNUMsT0FBTyxZQUFZLENBQUMsY0FBYyxLQUFLLFFBQVE7V0FDL0MsQ0FBQyxpQkFBaUIsQ0FBQyxJQUFJLENBQUMsWUFBWSxDQUFDLGNBQWMsQ0FBQztXQUNwRCxZQUFZLENBQUMsU0FBUyxLQUFLLG9CQUFvQjtXQUMvQyxDQUFDLGtCQUFrQixDQUFDLFlBQVksQ0FBQyxjQUFjLENBQUM7V0FDaEQsQ0FBQyxNQUFNLENBQUMsYUFBYSxDQUFDLFlBQVksQ0FBQyxzQkFBc0IsQ0FBQztXQUN6RCxZQUFZLENBQUMsc0JBQWlDLEdBQUcsQ0FBQztXQUNuRCxPQUFPLFlBQVksQ0FBQyxvQkFBb0IsS0FBSyxRQUFRO1dBQ3JELENBQUMsaUJBQWlCLENBQUMsSUFBSSxDQUFDLFlBQVksQ0FBQyxvQkFBb0IsQ0FBQztXQUMxRCxPQUFPLFlBQVksQ0FBQyxnQkFBZ0IsS0FBSyxRQUFRO1dBQ2pELENBQUMsaUJBQWlCLENBQUMsSUFBSSxDQUFDLFlBQVksQ0FBQyxnQkFBZ0IsQ0FBQztXQUN0RCxDQUFDLGtCQUFrQixDQUFDLFlBQVksQ0FBQyxlQUFlLENBQUM7V0FDakQsQ0FBQyxNQUFNLENBQUMsYUFBYSxDQUFDLFlBQVksQ0FBQyx1QkFBdUIsQ0FBQztXQUMxRCxZQUFZLENBQUMsdUJBQWtDLEdBQUcsQ0FBQyxFQUFFLENBQUM7UUFDMUQsT0FBTyxDQUFDLEdBQUcsT0FBTywwQ0FBMEMsQ0FBQyxDQUFDO0lBQ2hFLENBQUM7SUFDRCxPQUFPLEVBQUUsQ0FBQztBQUNaLENBQUMsQ0FBQztBQUVGLE1BQU0sQ0FBQyxNQUFNLG1DQUFtQyxHQUFHLENBQ2pELE9BQWdCLEVBQ2hCLDJCQUFzQyxFQUM1QixFQUFFO0lBQ1osSUFBSSxDQUFDLFFBQVEsQ0FBQyxPQUFPLENBQUM7UUFBRSxPQUFPLENBQUMsMENBQTBDLENBQUMsQ0FBQztJQUM1RSxNQUFNLE1BQU0sR0FBYSxFQUFFLENBQUM7SUFDNUIsSUFBSSxDQUFDLFlBQVksQ0FBQyxPQUFPLEVBQUU7UUFDekIsZUFBZTtRQUNmLFVBQVU7UUFDVixlQUFlO1FBQ2YsV0FBVztLQUNaLENBQUMsRUFBRSxDQUFDO1FBQ0gsTUFBTSxDQUFDLElBQUksQ0FBQyxrREFBa0QsQ0FBQyxDQUFDO0lBQ2xFLENBQUM7SUFDRCxJQUFJLE9BQU8sQ0FBQyxhQUFhLEtBQUssQ0FBQztRQUFFLE1BQU0sQ0FBQyxJQUFJLENBQUMsZ0RBQWdELENBQUMsQ0FBQztJQUMvRixJQUFJLENBQUMsTUFBTSxDQUFDLGFBQWEsQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLElBQUssT0FBTyxDQUFDLFFBQW1CLEdBQUcsQ0FBQyxFQUFFLENBQUM7UUFDaEYsTUFBTSxDQUFDLElBQUksQ0FBQyw0REFBNEQsQ0FBQyxDQUFDO0lBQzVFLENBQUM7SUFDRCxJQUFJLENBQUMsTUFBTSxDQUFDLGFBQWEsQ0FBQyxPQUFPLENBQUMsU0FBUyxDQUFDLElBQUssT0FBTyxDQUFDLFNBQW9CLEdBQUcsQ0FBQyxFQUFFLENBQUM7UUFDbEYsTUFBTSxDQUFDLElBQUksQ0FBQyxpRUFBaUUsQ0FBQyxDQUFDO0lBQ2pGLENBQUM7SUFDRCxJQUFJLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxPQUFPLENBQUMsYUFBYSxDQUFDO1dBQ3BDLE9BQU8sQ0FBQyxhQUFhLENBQUMsTUFBTSxLQUFLLENBQUM7V0FDbEMsT0FBTyxDQUFDLGFBQWEsQ0FBQyxNQUFNLEdBQUcsR0FBRyxFQUFFLENBQUM7UUFDeEMsTUFBTSxDQUFDLElBQUksQ0FBQyx3RUFBd0UsQ0FBQyxDQUFDO1FBQ3RGLE9BQU8sTUFBTSxDQUFDO0lBQ2hCLENBQUM7SUFDRCxNQUFNLFVBQVUsR0FBYSxFQUFFLENBQUM7SUFDaEMsTUFBTSxzQkFBc0IsR0FBRyxJQUFJLEdBQUcsRUFBNEMsQ0FBQztJQUNuRixNQUFNLGlDQUFpQyxHQUFHLENBQ3hDLFlBQXFCLEVBQ3JCLG9CQUE0QixFQUM1QixPQUFlLEVBQ1QsRUFBRTtRQUNSLE1BQU0sZUFBZSxHQUFHLHVDQUF1QyxDQUM3RCxZQUFZLEVBQ1osb0JBQW9CLEVBQ3BCLE9BQU8sQ0FDUixDQUFDO1FBQ0YsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLGVBQWUsQ0FBQyxDQUFDO1FBQ2hDLElBQUksZUFBZSxDQUFDLE1BQU0sR0FBRyxDQUFDO1lBQUUsT0FBTztRQUN2QyxNQUFNLFNBQVMsR0FBRyxZQUFnRCxDQUFDO1FBQ25FLE1BQU0saUJBQWlCLEdBQUcsc0JBQXNCLENBQUMsR0FBRyxDQUFDLFNBQVMsQ0FBQyxVQUFVLENBQUMsQ0FBQztRQUMzRSxJQUNFLGlCQUFpQjtlQUNkLENBQUMscUNBQXFDLENBQUMsaUJBQWlCLEVBQUUsU0FBUyxDQUFDLEVBQ3ZFLENBQUM7WUFDRCxNQUFNLENBQUMsSUFBSSxDQUNULEdBQUcsT0FBTyxnRkFBZ0YsQ0FDM0YsQ0FBQztZQUNGLE9BQU87UUFDVCxDQUFDO1FBQ0Qsc0JBQXNCLENBQUMsR0FBRyxDQUFDLFNBQVMsQ0FBQyxVQUFVLEVBQUUsU0FBUyxDQUFDLENBQUM7SUFDOUQsQ0FBQyxDQUFDO0lBQ0YsS0FBSyxNQUFNLENBQUMsS0FBSyxFQUFFLFNBQVMsQ0FBQyxJQUFJLE9BQU8sQ0FBQyxhQUFhLENBQUMsT0FBTyxFQUFFLEVBQUUsQ0FBQztRQUNqRSxNQUFNLElBQUksR0FBRyx3Q0FBd0MsS0FBSyxHQUFHLENBQUM7UUFDOUQsSUFBSSxDQUFDLFFBQVEsQ0FBQyxTQUFTLENBQUMsSUFBSSxDQUFDLGtCQUFrQixDQUFDLFNBQVMsQ0FBQyxTQUFTLENBQUMsRUFBRSxDQUFDO1lBQ3JFLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxJQUFJLDhCQUE4QixDQUFDLENBQUM7WUFDbkQsU0FBUztRQUNYLENBQUM7UUFDRCxJQUFJLENBQUMsV0FBVyxDQUFDLFNBQVMsRUFBRTtZQUMxQixXQUFXO1lBQ1gsaUJBQWlCO1lBQ2pCLGlCQUFpQjtZQUNqQiwwQkFBMEI7WUFDMUIsUUFBUTtZQUNSLFdBQVc7U0FDWixDQUFDLEVBQUUsQ0FBQztZQUNILE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxJQUFJLDhCQUE4QixDQUFDLENBQUM7UUFDckQsQ0FBQztRQUNELFVBQVUsQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLFNBQVMsQ0FBQyxDQUFDO1FBQ3JDLGlDQUFpQyxDQUMvQixTQUFTLENBQUMsZUFBZSxFQUN6QixTQUFTLENBQUMsU0FBUyxFQUNuQixHQUFHLElBQUksa0JBQWtCLENBQzFCLENBQUM7UUFDRixJQUFJLFNBQVMsQ0FBQyxlQUFlLEtBQUssU0FBUyxFQUFFLENBQUM7WUFDNUMsaUNBQWlDLENBQy9CLFNBQVMsQ0FBQyxlQUFlLEVBQ3pCLFNBQVMsQ0FBQyxTQUFTLEVBQ25CLEdBQUcsSUFBSSxrQkFBa0IsQ0FDMUIsQ0FBQztRQUNKLENBQUM7UUFDRCxJQUFJLFNBQVMsQ0FBQyx3QkFBd0IsS0FBSyxTQUFTLEVBQUUsQ0FBQztZQUNyRCxJQUFJLENBQUMsUUFBUSxDQUFDLFNBQVMsQ0FBQyx3QkFBd0IsQ0FBQzttQkFDNUMsQ0FBQyxZQUFZLENBQUMsU0FBUyxDQUFDLHdCQUF3QixFQUFFLENBQUMsVUFBVSxFQUFFLGVBQWUsQ0FBQyxDQUFDO21CQUNoRixDQUFDLE1BQU0sQ0FBQyxhQUFhLENBQUMsU0FBUyxDQUFDLHdCQUF3QixDQUFDLGFBQWEsQ0FBQzttQkFDdEUsU0FBUyxDQUFDLHdCQUF3QixDQUFDLGFBQXdCLEdBQUcsQ0FBQyxFQUFFLENBQUM7Z0JBQ3RFLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxJQUFJLDhEQUE4RCxDQUFDLENBQUM7WUFDckYsQ0FBQztpQkFBTSxDQUFDO2dCQUNOLGlDQUFpQyxDQUMvQixTQUFTLENBQUMsd0JBQXdCLENBQUMsUUFBUSxFQUMzQyxTQUFTLENBQUMsU0FBUyxFQUNuQixHQUFHLElBQUksb0NBQW9DLENBQzVDLENBQUM7Z0JBQ0YsSUFDRSxNQUFNLENBQUMsYUFBYSxDQUFDLFNBQVMsQ0FBQyxTQUFTLENBQUM7dUJBQ3JDLFNBQVMsQ0FBQyx3QkFBd0IsQ0FBQyxhQUF3QjswQkFDMUQsU0FBUyxDQUFDLFNBQW9CLEVBQ25DLENBQUM7b0JBQ0QsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLElBQUksNERBQTRELENBQUMsQ0FBQztnQkFDbkYsQ0FBQztZQUNILENBQUM7UUFDSCxDQUFDO1FBQ0QsSUFBSSxDQUFDO1lBQ0gsU0FBUztZQUNULFVBQVU7WUFDVixTQUFTO1lBQ1QsU0FBUztZQUNULFFBQVE7U0FDVCxDQUFDLFFBQVEsQ0FBQyxTQUFTLENBQUMsTUFBZ0IsQ0FBQyxFQUFFLENBQUM7WUFDdkMsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLElBQUksMkJBQTJCLENBQUMsQ0FBQztRQUNsRCxDQUFDO1FBQ0QsSUFBSSxDQUFDLE1BQU0sQ0FBQyxhQUFhLENBQUMsU0FBUyxDQUFDLFNBQVMsQ0FBQyxJQUFLLFNBQVMsQ0FBQyxTQUFvQixHQUFHLENBQUMsRUFBRSxDQUFDO1lBQ3RGLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxJQUFJLDJDQUEyQyxDQUFDLENBQUM7UUFDbEUsQ0FBQztRQUNELElBQ0UsU0FBUyxDQUFDLE1BQU0sS0FBSyxTQUFTO2VBQzNCLENBQUMscUNBQXFDLENBQ3ZDLFNBQVMsQ0FBQyxlQUE4RCxFQUN4RSxTQUFTLENBQUMsZUFBOEQsQ0FDekUsRUFDRCxDQUFDO1lBQ0QsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLElBQUksNkRBQTZELENBQUMsQ0FBQztRQUNwRixDQUFDO0lBQ0gsQ0FBQztJQUNELElBQUksSUFBSSxHQUFHLENBQUMsVUFBVSxDQUFDLENBQUMsSUFBSSxLQUFLLFVBQVUsQ0FBQyxNQUFNLEVBQUUsQ0FBQztRQUNuRCxNQUFNLENBQUMsSUFBSSxDQUFDLHFFQUFxRSxDQUFDLENBQUM7SUFDckYsQ0FBQztJQUNELElBQUksMkJBQTJCLEVBQUUsQ0FBQztRQUNoQyxNQUFNLFFBQVEsR0FBRyxDQUFDLEdBQUcsSUFBSSxHQUFHLENBQUMsMkJBQTJCLENBQUMsQ0FBQyxDQUFDLElBQUksRUFBRSxDQUFDO1FBQ2xFLElBQUksSUFBSSxDQUFDLFNBQVMsQ0FBQyxDQUFDLEdBQUcsVUFBVSxDQUFDLENBQUMsSUFBSSxFQUFFLENBQUMsS0FBSyxJQUFJLENBQUMsU0FBUyxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUM7WUFDeEUsTUFBTSxDQUFDLElBQUksQ0FBQywrRUFBK0UsQ0FBQyxDQUFDO1FBQy9GLENBQUM7SUFDSCxDQUFDO0lBQ0QsT0FBTyxNQUFNLENBQUM7QUFDaEIsQ0FBQyxDQUFDO0FBRUYsTUFBTSxDQUFDLE1BQU0sOEJBQThCLEdBQUcsc0NBQStDLENBQUM7QUFDOUYsTUFBTSxDQUFDLE1BQU0sOEJBQThCLEdBQUcsMENBQW1ELENBQUM7QUFDbEcsTUFBTSxDQUFDLE1BQU0sd0JBQXdCLEdBQUcsZ0NBQXlDLENBQUM7QUFDbEYsTUFBTSxDQUFDLE1BQU0sMEJBQTBCLEdBQ3JDLDZEQUFzRSxDQUFDO0FBQ3pFLE1BQU0sQ0FBQyxNQUFNLDhCQUE4QixHQUFHLEtBQWMsQ0FBQztBQUM3RCxNQUFNLENBQUMsTUFBTSw2QkFBNkIsR0FBRyxJQUFhLENBQUM7QUFFM0QsTUFBTSxxQkFBcUIsR0FBRyxDQUFDLFFBQW9CLEVBQVUsRUFBRTtJQUM3RCxNQUFNLFFBQVEsR0FBRyxrQ0FBa0MsQ0FBQztJQUNwRCxJQUFJLE1BQU0sR0FBRyxFQUFFLENBQUM7SUFDaEIsSUFBSSxXQUFXLEdBQUcsQ0FBQyxDQUFDO0lBQ3BCLElBQUksUUFBUSxHQUFHLENBQUMsQ0FBQztJQUNqQixLQUFLLE1BQU0sSUFBSSxJQUFJLFFBQVEsRUFBRSxDQUFDO1FBQzVCLFdBQVcsR0FBRyxDQUFDLFdBQVcsSUFBSSxDQUFDLENBQUMsR0FBRyxJQUFJLENBQUM7UUFDeEMsUUFBUSxJQUFJLENBQUMsQ0FBQztRQUNkLE9BQU8sUUFBUSxJQUFJLENBQUMsRUFBRSxDQUFDO1lBQ3JCLFFBQVEsSUFBSSxDQUFDLENBQUM7WUFDZCxNQUFNLElBQUksUUFBUSxDQUFDLENBQUMsV0FBVyxLQUFLLFFBQVEsQ0FBQyxHQUFHLEVBQUUsQ0FBQyxDQUFDO1FBQ3RELENBQUM7UUFDRCxXQUFXLElBQUksQ0FBQyxDQUFDLElBQUksUUFBUSxDQUFDLEdBQUcsQ0FBQyxDQUFDO0lBQ3JDLENBQUM7SUFDRCxJQUFJLFFBQVEsR0FBRyxDQUFDO1FBQUUsTUFBTSxJQUFJLFFBQVEsQ0FBQyxDQUFDLFdBQVcsSUFBSSxDQUFDLENBQUMsR0FBRyxRQUFRLENBQUMsQ0FBQyxHQUFHLEVBQUUsQ0FBQyxDQUFDO0lBQzNFLE9BQU8sTUFBTSxDQUFDO0FBQ2hCLENBQUMsQ0FBQztBQUVGLGdGQUFnRjtBQUNoRixNQUFNLENBQUMsTUFBTSw4QkFBOEIsR0FBRyxLQUFLLEVBQ2pELGtCQUEwQixFQUNDLEVBQUU7SUFDN0IsSUFBSSxDQUFDLGtCQUFrQixDQUFDLGtCQUFrQixDQUFDLEVBQUUsQ0FBQztRQUM1QyxNQUFNLElBQUksS0FBSyxDQUFDLGdEQUFnRCxDQUFDLENBQUM7SUFDcEUsQ0FBQztJQUNELE1BQU0sTUFBTSxHQUFHLElBQUksVUFBVSxDQUFDLE1BQU0sVUFBVSxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUNqRSxTQUFTLEVBQ1QsSUFBSSxXQUFXLEVBQUUsQ0FBQyxNQUFNLENBQUMsR0FBRyw4QkFBOEIsS0FBSyxrQkFBa0IsRUFBRSxDQUFDLENBQ3JGLENBQUMsQ0FBQztJQUNILE1BQU0sT0FBTyxHQUFHLHFCQUFxQixDQUFDLE1BQU0sQ0FBQyxDQUFDO0lBQzlDLElBQUksT0FBTyxDQUFDLE1BQU0sS0FBSyxFQUFFO1FBQUUsTUFBTSxJQUFJLEtBQUssQ0FBQyxrQ0FBa0MsQ0FBQyxDQUFDO0lBQy9FLE9BQU8sUUFBUSxPQUFPLEVBQUUsQ0FBQztBQUMzQixDQUFDLENBQUM7QUFFRixNQUFNLENBQUMsTUFBTSw4QkFBOEIsR0FBRyxDQUM1QyxXQUFtQixFQUNrQixFQUFFO0lBQ3ZDLElBQUksQ0FBQyxxQkFBcUIsQ0FBQyxJQUFJLENBQUMsV0FBVyxDQUFDLEVBQUUsQ0FBQztRQUM3QyxNQUFNLElBQUksS0FBSyxDQUFDLDhEQUE4RCxDQUFDLENBQUM7SUFDbEYsQ0FBQztJQUNELE9BQU8sMkJBQTJCLFdBQVcsRUFBRSxDQUFDO0FBQ2xELENBQUMsQ0FBQztBQWVGOzs7OztHQUtHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sZ0NBQWdDLEdBQUcsS0FBSyxFQUNuRCxXQUFvQyxFQUNJLEVBQUU7SUFDMUMsSUFBSSw4QkFBOEIsQ0FBQyxXQUFXLENBQUMsQ0FBQyxNQUFNLEdBQUcsQ0FBQztXQUNyRCxDQUFDLE1BQU0sa0NBQWtDLENBQUMsV0FBVyxDQUFDLEVBQUUsQ0FBQztRQUM1RCxNQUFNLElBQUksS0FBSyxDQUFDLDZEQUE2RCxDQUFDLENBQUM7SUFDakYsQ0FBQztJQUNELE1BQU0sT0FBTyxHQUFHLE1BQU0sT0FBTyxDQUFDLEdBQUcsQ0FBQyxXQUFXLENBQUMsT0FBTztTQUNsRCxNQUFNLENBQUMsQ0FBQyxRQUFRLEVBQUUsRUFBRSxDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUMsSUFBSSxLQUFLLHNCQUFzQixDQUFDO1NBQ3ZFLEdBQUcsQ0FBQyxLQUFLLEVBQUUsUUFBUSxFQUFFLEVBQUU7UUFDdEIsTUFBTSxRQUFRLEdBQUcsTUFBTSw4QkFBOEIsQ0FBQyxRQUFRLENBQUMsZUFBZSxDQUFDLENBQUM7UUFDaEYsT0FBTztZQUNMLFlBQVksRUFBRyxRQUFRLENBQUMsUUFBK0MsQ0FBQyxZQUFZO1lBQ3BGLFFBQVE7WUFDUixNQUFNLEVBQUUsOEJBQThCLENBQUMsUUFBUSxDQUFDO1NBQ2pELENBQUM7SUFDSixDQUFDLENBQUMsQ0FBQyxDQUFDO0lBQ04sT0FBTyxDQUFDLElBQUksQ0FBQyxDQUFDLE9BQU8sRUFBRSxRQUFRLEVBQUUsRUFBRSxDQUFDLENBQ2xDLE9BQU8sQ0FBQyxZQUFZLEdBQUcsUUFBUSxDQUFDLFlBQVk7UUFDMUMsQ0FBQyxDQUFDLENBQUMsQ0FBQztRQUNKLENBQUMsQ0FBQyxPQUFPLENBQUMsWUFBWSxHQUFHLFFBQVEsQ0FBQyxZQUFZLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUN6RCxDQUFDLENBQUM7SUFDSCxJQUFJLElBQUksR0FBRyxDQUFDLE9BQU8sQ0FBQyxHQUFHLENBQUMsQ0FBQyxRQUFRLEVBQUUsRUFBRSxDQUFDLFFBQVEsQ0FBQyxZQUFZLENBQUMsQ0FBQyxDQUFDLElBQUksS0FBSyxPQUFPLENBQUMsTUFBTTtXQUNoRixJQUFJLEdBQUcsQ0FBQyxPQUFPLENBQUMsR0FBRyxDQUFDLENBQUMsUUFBUSxFQUFFLEVBQUUsQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQyxJQUFJLEtBQUssT0FBTyxDQUFDLE1BQU07V0FDN0UsSUFBSSxHQUFHLENBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQyxDQUFDLFFBQVEsRUFBRSxFQUFFLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUMsSUFBSSxLQUFLLE9BQU8sQ0FBQyxNQUFNLEVBQUUsQ0FBQztRQUNqRixNQUFNLElBQUksS0FBSyxDQUFDLGtGQUFrRixDQUFDLENBQUM7SUFDdEcsQ0FBQztJQUNELE9BQU87UUFDTCxhQUFhLEVBQUUsQ0FBQztRQUNoQixVQUFVLEVBQUUsV0FBVyxDQUFDLEVBQUU7UUFDMUIsY0FBYyxFQUFFLFdBQVcsQ0FBQyxNQUFNO1FBQ2xDLE9BQU87S0FDUixDQUFDO0FBQ0osQ0FBQyxDQUFDO0FBRUYsTUFBTSxDQUFDLE1BQU0sZ0NBQWdDLEdBQUcsS0FBSyxFQUNuRCxNQUFlLEVBQ2YsV0FBb0MsRUFDbEIsRUFBRTtJQUNwQixJQUFJLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQztXQUNoQixDQUFDLFlBQVksQ0FBQyxNQUFNLEVBQUUsQ0FBQyxlQUFlLEVBQUUsWUFBWSxFQUFFLGdCQUFnQixFQUFFLFNBQVMsQ0FBQyxDQUFDLEVBQUUsQ0FBQztRQUN6RixPQUFPLEtBQUssQ0FBQztJQUNmLENBQUM7SUFDRCxJQUFJLENBQUM7UUFDSCxNQUFNLFFBQVEsR0FBRyxNQUFNLGdDQUFnQyxDQUFDLFdBQVcsQ0FBQyxDQUFDO1FBQ3JFLE9BQU8sSUFBSSxDQUFDLFNBQVMsQ0FBQyxNQUFNLENBQUMsS0FBSyxJQUFJLENBQUMsU0FBUyxDQUFDLFFBQVEsQ0FBQyxDQUFDO0lBQzdELENBQUM7SUFBQyxNQUFNLENBQUM7UUFDUCxPQUFPLEtBQUssQ0FBQztJQUNmLENBQUM7QUFDSCxDQUFDLENBQUM7QUFPRixNQUFNLENBQUMsTUFBTSxtQ0FBbUMsR0FBRyxDQUNqRCxlQUF5QixFQUNPLEVBQUU7SUFDbEMsSUFBSSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsZUFBZSxDQUFDO1dBQzlCLGVBQWUsQ0FBQyxNQUFNLEtBQUssQ0FBQztXQUM1QixlQUFlLENBQUMsSUFBSSxDQUFDLENBQUMsV0FBVyxFQUFFLEVBQUUsQ0FBQyxPQUFPLFdBQVcsS0FBSyxRQUFRO2VBQ25FLFdBQVcsQ0FBQyxNQUFNLEtBQUssQ0FBQztlQUN4QixXQUFXLENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQyxDQUFDLEVBQUUsQ0FBQztRQUNuQyxNQUFNLElBQUksS0FBSyxDQUFDLDZEQUE2RCxDQUFDLENBQUM7SUFDakYsQ0FBQztJQUNELE9BQU87UUFDTCxPQUFPLEVBQUUsQ0FBQywwQkFBMEIsQ0FBQztRQUNyQyxJQUFJLEVBQUUsQ0FBQyxLQUFLLEVBQUUsT0FBTyxFQUFFLDhCQUE4QixFQUFFLElBQUksRUFBRSxHQUFHLGVBQWUsQ0FBQztLQUNqRixDQUFDO0FBQ0osQ0FBQyxDQUFDO0FBa0RGLE1BQU0sQ0FBQyxNQUFNLHFCQUFxQixHQUFHLE1BQU0sQ0FBQyxNQUFNLENBQUM7SUFDakQsaUJBQWlCLEVBQUUsRUFBRTtDQUN0QixDQUFDLENBQUM7QUFFSCxNQUFNLHVCQUF1QixHQUFHLHVDQUF1QyxDQUFDO0FBRXhFLE1BQU0sQ0FBQyxNQUFNLCtCQUErQixHQUFHLENBQzdDLFlBQXFCLEVBQ1gsRUFBRTtJQUNaLElBQUksQ0FBQyxRQUFRLENBQUMsWUFBWSxDQUFDO1FBQUUsT0FBTyxDQUFDLG9DQUFvQyxDQUFDLENBQUM7SUFDM0UsTUFBTSxjQUFjLEdBQUcsWUFBWSxDQUFDLGNBQWMsQ0FBQztJQUNuRCxNQUFNLFlBQVksR0FBRyxjQUFjLEtBQUssUUFBUTtRQUM5QyxDQUFDLENBQUMsQ0FBQyxlQUFlLEVBQUUsZ0JBQWdCLEVBQUUsV0FBVyxFQUFFLFlBQVksRUFBRSxhQUFhLEVBQUUsZ0JBQWdCLENBQUM7UUFDakcsQ0FBQyxDQUFDLGNBQWMsS0FBSyxVQUFVO1lBQzdCLENBQUMsQ0FBQyxDQUFDLGVBQWUsRUFBRSxnQkFBZ0IsRUFBRSxXQUFXLEVBQUUsWUFBWSxFQUFFLGFBQWEsRUFBRSxnQkFBZ0IsRUFBRSxhQUFhLENBQUM7WUFDaEgsQ0FBQyxDQUFDLGNBQWMsS0FBSyxTQUFTO2dCQUM1QixDQUFDLENBQUMsQ0FBQyxlQUFlLEVBQUUsZ0JBQWdCLEVBQUUsV0FBVyxFQUFFLFlBQVksRUFBRSxhQUFhLEVBQUUsZ0JBQWdCLEVBQUUsV0FBVyxDQUFDO2dCQUM5RyxDQUFDLENBQUMsRUFBRSxDQUFDO0lBQ1gsSUFBSSxZQUFZLENBQUMsTUFBTSxLQUFLLENBQUMsSUFBSSxDQUFDLFlBQVksQ0FBQyxZQUFZLEVBQUUsWUFBWSxDQUFDLEVBQUUsQ0FBQztRQUMzRSxPQUFPLENBQUMsc0RBQXNELENBQUMsQ0FBQztJQUNsRSxDQUFDO0lBQ0QsTUFBTSxNQUFNLEdBQWEsRUFBRSxDQUFDO0lBQzVCLElBQUksWUFBWSxDQUFDLGFBQWEsS0FBSyxDQUFDO1FBQUUsTUFBTSxDQUFDLElBQUksQ0FBQywwQ0FBMEMsQ0FBQyxDQUFDO0lBQzlGLElBQUksQ0FBQyxrQkFBa0IsQ0FBQyxZQUFZLENBQUMsY0FBYyxDQUFDLEVBQUUsQ0FBQztRQUNyRCxNQUFNLENBQUMsSUFBSSxDQUFDLDJDQUEyQyxDQUFDLENBQUM7SUFDM0QsQ0FBQztJQUNELElBQUksT0FBTyxZQUFZLENBQUMsU0FBUyxLQUFLLFFBQVE7V0FDekMsQ0FBQyx1QkFBdUIsQ0FBQyxJQUFJLENBQUMsWUFBWSxDQUFDLFNBQVMsQ0FBQyxFQUFFLENBQUM7UUFDM0QsTUFBTSxDQUFDLElBQUksQ0FBQyw2RUFBNkUsQ0FBQyxDQUFDO0lBQzdGLENBQUM7SUFDRCxLQUFLLE1BQU0sS0FBSyxJQUFJLENBQUMsWUFBWSxFQUFFLGFBQWEsQ0FBVSxFQUFFLENBQUM7UUFDM0QsSUFBSSxDQUFDLE1BQU0sQ0FBQyxhQUFhLENBQUMsWUFBWSxDQUFDLEtBQUssQ0FBQyxDQUFDLElBQUssWUFBWSxDQUFDLEtBQUssQ0FBWSxHQUFHLENBQUMsRUFBRSxDQUFDO1lBQ3RGLE1BQU0sQ0FBQyxJQUFJLENBQUMsb0JBQW9CLEtBQUssNkJBQTZCLENBQUMsQ0FBQztRQUN0RSxDQUFDO0lBQ0gsQ0FBQztJQUNELElBQUksY0FBYyxLQUFLLFVBQVU7V0FDNUIsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxhQUFhLENBQUMsWUFBWSxDQUFDLFdBQVcsQ0FBQztlQUM3QyxZQUFZLENBQUMsV0FBc0IsSUFBSyxZQUFZLENBQUMsV0FBc0IsQ0FBQyxFQUFFLENBQUM7UUFDckYsTUFBTSxDQUFDLElBQUksQ0FBQyw4REFBOEQsQ0FBQyxDQUFDO0lBQzlFLENBQUM7SUFDRCxJQUFJLGNBQWMsS0FBSyxTQUFTO1dBQzNCLENBQUMsQ0FBQyxNQUFNLENBQUMsYUFBYSxDQUFDLFlBQVksQ0FBQyxTQUFTLENBQUM7ZUFDM0MsWUFBWSxDQUFDLFNBQW9CLEdBQUksWUFBWSxDQUFDLFdBQXNCLENBQUMsRUFBRSxDQUFDO1FBQ2xGLE1BQU0sQ0FBQyxJQUFJLENBQUMsZ0VBQWdFLENBQUMsQ0FBQztJQUNoRixDQUFDO0lBQ0QsT0FBTyxNQUFNLENBQUM7QUFDaEIsQ0FBQyxDQUFDO0FBRUYsTUFBTSxDQUFDLE1BQU0sMEJBQTBCLEdBQUcsQ0FDeEMsYUFBc0IsRUFDWixFQUFFO0lBQ1osSUFBSSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsYUFBYSxDQUFDO1dBQzVCLGFBQWEsQ0FBQyxNQUFNLEtBQUssQ0FBQztXQUMxQixhQUFhLENBQUMsTUFBTSxHQUFHLHFCQUFxQixDQUFDLGlCQUFpQixFQUFFLENBQUM7UUFDcEUsT0FBTztZQUNMLG1EQUFtRCxxQkFBcUIsQ0FBQyxpQkFBaUIsVUFBVTtTQUNyRyxDQUFDO0lBQ0osQ0FBQztJQUNELE1BQU0sTUFBTSxHQUFHLGFBQWEsQ0FBQyxPQUFPLENBQUMsQ0FBQyxZQUFZLEVBQUUsUUFBUSxFQUFFLEVBQUUsQ0FBQyxDQUMvRCwrQkFBK0IsQ0FBQyxZQUFZLENBQUM7U0FDMUMsR0FBRyxDQUFDLENBQUMsUUFBUSxFQUFFLEVBQUUsQ0FBQyxjQUFjLFFBQVEsS0FBSyxRQUFRLEVBQUUsQ0FBQyxDQUM1RCxDQUFDLENBQUM7SUFDSCxNQUFNLFVBQVUsR0FBRyxhQUFhLENBQUMsTUFBTSxDQUFDLFFBQVEsQ0FBQyxDQUFDO0lBQ2xELElBQUksVUFBVSxDQUFDLE1BQU0sQ0FBQyxDQUFDLFlBQVksRUFBRSxFQUFFLENBQUMsWUFBWSxDQUFDLGNBQWMsS0FBSyxRQUFRLENBQUMsQ0FBQyxNQUFNLEtBQUssQ0FBQyxFQUFFLENBQUM7UUFDL0YsTUFBTSxDQUFDLElBQUksQ0FBQyxnRUFBZ0UsQ0FBQyxDQUFDO0lBQ2hGLENBQUM7SUFDRCxNQUFNLE1BQU0sR0FBRyxVQUFVLENBQUMsR0FBRyxDQUFDLENBQUMsWUFBWSxFQUFFLEVBQUUsQ0FBQyxZQUFZLENBQUMsY0FBYyxDQUFDLENBQUM7SUFDN0UsTUFBTSxXQUFXLEdBQUcsVUFBVSxDQUFDLEdBQUcsQ0FBQyxDQUFDLFlBQVksRUFBRSxFQUFFLENBQUMsWUFBWSxDQUFDLFVBQVUsQ0FBQyxDQUFDO0lBQzlFLElBQUksSUFBSSxHQUFHLENBQUMsTUFBTSxDQUFDLENBQUMsSUFBSSxLQUFLLE1BQU0sQ0FBQyxNQUFNO1FBQUUsTUFBTSxDQUFDLElBQUksQ0FBQyx5Q0FBeUMsQ0FBQyxDQUFDO0lBQ25HLElBQUksSUFBSSxHQUFHLENBQUMsV0FBVyxDQUFDLENBQUMsSUFBSSxLQUFLLFdBQVcsQ0FBQyxNQUFNLEVBQUUsQ0FBQztRQUNyRCxNQUFNLENBQUMsSUFBSSxDQUFDLDZDQUE2QyxDQUFDLENBQUM7SUFDN0QsQ0FBQztJQUNELE1BQU0sZUFBZSxHQUFHLFVBQVUsQ0FBQyxJQUFJLENBQUMsQ0FBQyxZQUFZLEVBQUUsRUFBRSxDQUFDLFlBQVksQ0FBQyxjQUFjLEtBQUssUUFBUSxDQUFDLENBQUM7SUFDcEcsTUFBTSxrQkFBa0IsR0FBRyxXQUFXLENBQUMsTUFBTSxDQUFDLENBQUMsYUFBYSxFQUEyQixFQUFFLENBQUMsQ0FDeEYsTUFBTSxDQUFDLGFBQWEsQ0FBQyxhQUFhLENBQUMsQ0FDcEMsQ0FBQyxDQUFDO0lBQ0gsSUFBSSxlQUFlO1dBQ2QsTUFBTSxDQUFDLGFBQWEsQ0FBQyxlQUFlLENBQUMsVUFBVSxDQUFDO1dBQ2hELGtCQUFrQixDQUFDLE1BQU0sR0FBRyxDQUFDO1dBQzdCLGVBQWUsQ0FBQyxVQUFVLEtBQUssSUFBSSxDQUFDLEdBQUcsQ0FBQyxHQUFHLGtCQUFrQixDQUFDLEVBQUUsQ0FBQztRQUNwRSxNQUFNLENBQUMsSUFBSSxDQUFDLCtEQUErRCxDQUFDLENBQUM7SUFDL0UsQ0FBQztJQUNELE9BQU8sTUFBTSxDQUFDO0FBQ2hCLENBQUMsQ0FBQztBQUVGLG1EQUFtRDtBQUNuRCxNQUFNLENBQUMsTUFBTSx5QkFBeUIsR0FBRyxDQUN2QyxZQUFzQyxFQUM3QixFQUFFLENBQUMsWUFBWSxDQUFDLGNBQWMsS0FBSyxRQUFRLENBQUM7QUFFdkQsTUFBTSxDQUFDLE1BQU0sb0NBQW9DLEdBQUcsS0FBSyxFQUN2RCxhQUFzQixFQUN0QixZQUFzQyxFQUN0QyxrQkFBOEIsRUFDWCxFQUFFO0lBQ3JCLE1BQU0sTUFBTSxHQUFHLHdCQUF3QixDQUFDLGFBQWEsQ0FBQyxDQUFDO0lBQ3ZELElBQUksTUFBTSxDQUFDLE1BQU0sR0FBRyxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsYUFBYSxDQUFDLElBQUksYUFBYSxDQUFDLElBQUksS0FBSyxRQUFRLEVBQUUsQ0FBQztRQUNyRixPQUFPLE1BQU0sQ0FBQztJQUNoQixDQUFDO0lBQ0QsSUFBSSxDQUFDLHlCQUF5QixDQUFDLFlBQVksQ0FBQyxFQUFFLENBQUM7UUFDN0MsTUFBTSxDQUFDLElBQUksQ0FBQyx3REFBd0QsQ0FBQyxDQUFDO0lBQ3hFLENBQUM7SUFDRCxJQUFJLENBQUM7UUFDSCxNQUFNLFFBQVEsR0FBRyxPQUFPLENBQUMsV0FBVyxDQUFDLG1CQUFtQixDQUFDLGFBQWEsQ0FBQyxRQUFRLENBQUMsQ0FBQztRQUNqRixJQUFJLFFBQVEsQ0FBQyxjQUFjLEtBQUssWUFBWSxDQUFDLGNBQWMsRUFBRSxDQUFDO1lBQzVELE1BQU0sQ0FBQyxJQUFJLENBQUMsb0VBQW9FLENBQUMsQ0FBQztRQUNwRixDQUFDO1FBQ0QsSUFBSSxDQUFDLE1BQU0sMkJBQTJCLENBQUMsUUFBUSxFQUFFLGtCQUFrQixDQUFDLEVBQUUsQ0FBQztZQUNyRSxNQUFNLENBQUMsSUFBSSxDQUFDLGlEQUFpRCxDQUFDLENBQUM7UUFDakUsQ0FBQztJQUNILENBQUM7SUFBQyxNQUFNLENBQUM7UUFDUCxnRUFBZ0U7SUFDbEUsQ0FBQztJQUNELE9BQU8sTUFBTSxDQUFDO0FBQ2hCLENBQUMsQ0FBQztBQUVGLG9GQUFvRjtBQUNwRixNQUFNLENBQUMsTUFBTSwyQkFBMkIsR0FBRyxDQUN6QyxZQUFzQyxFQUN0QyxXQUFtQixFQUNuQixNQUFjLEVBQ0wsRUFBRSxDQUFDLE1BQU0sQ0FBQyxhQUFhLENBQUMsV0FBVyxDQUFDO09BQzFDLE1BQU0sQ0FBQyxhQUFhLENBQUMsTUFBTSxDQUFDO09BQzVCLFdBQVcsSUFBSSxZQUFZLENBQUMsV0FBVztPQUN2QyxXQUFXLElBQUksTUFBTTtPQUNyQixDQUFDLFlBQVksQ0FBQyxjQUFjLEtBQUssUUFBUTtXQUN6QyxDQUFDLFlBQVksQ0FBQyxjQUFjLEtBQUssVUFBVTtlQUN6QyxXQUFXLEdBQUcsWUFBWSxDQUFDLFdBQVc7ZUFDdEMsTUFBTSxHQUFHLFlBQVksQ0FBQyxXQUFXLENBQUMsQ0FBQyxDQUFDO0FBRTNDLE1BQU0sb0JBQW9CLEdBQUcsQ0FBQyxRQUFzQixFQUEwQixFQUFFO0lBQzlFLFFBQVEsUUFBUSxDQUFDLElBQUksRUFBRSxDQUFDO1FBQ3RCLEtBQUssU0FBUyxDQUFDLENBQUMsT0FBTyxFQUFFLElBQUksRUFBRSxRQUFRLENBQUMsSUFBSSxFQUFFLFNBQVMsRUFBRSxRQUFRLENBQUMsU0FBUyxFQUFFLENBQUM7UUFDOUUsS0FBSyxZQUFZLENBQUMsQ0FBQyxPQUFPLEVBQUUsSUFBSSxFQUFFLFFBQVEsQ0FBQyxJQUFJLEVBQUUsV0FBVyxFQUFFLFFBQVEsQ0FBQyxXQUFXLEVBQUUsQ0FBQztRQUNyRixLQUFLLG1CQUFtQixDQUFDLENBQUMsT0FBTztZQUMvQixJQUFJLEVBQUUsUUFBUSxDQUFDLElBQUk7WUFDbkIsZ0JBQWdCLEVBQUUsUUFBUSxDQUFDLGdCQUFnQjtTQUM1QyxDQUFDO1FBQ0YsS0FBSyxRQUFRLENBQUMsQ0FBQyxPQUFPLEVBQUUsSUFBSSxFQUFFLFFBQVEsQ0FBQyxJQUFJLEVBQUUsUUFBUSxFQUFFLFFBQVEsQ0FBQyxRQUFRLEVBQUUsQ0FBQztJQUM3RSxDQUFDO0FBQ0gsQ0FBQyxDQUFDO0FBRUYsTUFBTSx1QkFBdUIsR0FBRyxDQUFDLFdBQTRCLEVBQTJCLEVBQUUsQ0FBQyxDQUN6RixXQUFXLENBQUMsSUFBSSxLQUFLLHNCQUFzQjtJQUN6QyxDQUFDLENBQUM7UUFDRSxJQUFJLEVBQUUsV0FBVyxDQUFDLElBQUk7UUFDdEIsWUFBWSxFQUFFLFdBQVcsQ0FBQyxZQUFZO1FBQ3RDLEdBQUcsRUFBRSxXQUFXLENBQUMsR0FBRztRQUNwQixHQUFHLEVBQUUsV0FBVyxDQUFDLEdBQUc7UUFDcEIsSUFBSSxFQUFFLFdBQVcsQ0FBQyxJQUFJO0tBQ3ZCO0lBQ0gsQ0FBQyxDQUFDO1FBQ0UsSUFBSSxFQUFFLFdBQVcsQ0FBQyxJQUFJO1FBQ3RCLFVBQVUsRUFBRSxXQUFXLENBQUMsVUFBVTtRQUNsQyxHQUFHLEVBQUUsV0FBVyxDQUFDLEdBQUc7UUFDcEIsR0FBRyxFQUFFLFdBQVcsQ0FBQyxHQUFHO1FBQ3BCLElBQUksRUFBRSxXQUFXLENBQUMsSUFBSTtLQUN2QixDQUNOLENBQUM7QUFFRixNQUFNLFlBQVksR0FBRyxDQUFDLFFBQWlDLEVBQWMsRUFBRSxDQUFDLENBQ3RFLElBQUksV0FBVyxFQUFFLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FDbkQsQ0FBQztBQUVGLE1BQU0sQ0FBQyxNQUFNLGlDQUFpQyxHQUFHLENBQUMsVUFPakQsRUFBYyxFQUFFLENBQUMsWUFBWSxDQUFDO0lBQzdCLGFBQWEsRUFBRSxDQUFDO0lBQ2hCLE9BQU8sRUFBRSwwQkFBMEI7SUFDbkMsVUFBVSxFQUFFLFVBQVUsQ0FBQyxVQUFVO0lBQ2pDLE1BQU0sRUFBRSxvQkFBb0IsQ0FBQyxVQUFVLENBQUMsTUFBTSxDQUFDO0lBQy9DLEdBQUcsRUFBRSxVQUFVLENBQUMsR0FBRztJQUNuQixXQUFXLEVBQUUsVUFBVSxDQUFDLFdBQVc7SUFDbkMsUUFBUSxFQUFFLHVCQUF1QixDQUFDLFVBQVUsQ0FBQyxRQUFRLENBQUM7SUFDdEQsNkJBQTZCLEVBQUUsVUFBVSxDQUFDLDZCQUE2QjtDQUN4RSxDQUFDLENBQUM7QUFFSCxNQUFNLENBQUMsTUFBTSxpQ0FBaUMsR0FBRyxDQUFDLFVBTWpELEVBQWMsRUFBRSxDQUFDLFlBQVksQ0FBQztJQUM3QixhQUFhLEVBQUUsQ0FBQztJQUNoQixPQUFPLEVBQUUsMEJBQTBCO0lBQ25DLFVBQVUsRUFBRSxVQUFVLENBQUMsVUFBVTtJQUNqQyxRQUFRLEVBQUUsVUFBVSxDQUFDLFFBQVE7SUFDN0Isc0JBQXNCLEVBQUUsVUFBVSxDQUFDLHNCQUFzQjtJQUN6RCx1QkFBdUIsRUFBRSxVQUFVLENBQUMsdUJBQXVCO0lBQzNELDZCQUE2QixFQUFFLFVBQVUsQ0FBQyw2QkFBNkI7Q0FDeEUsQ0FBQyxDQUFDO0FBRUgsTUFBTSxDQUFDLE1BQU0sMENBQTBDLEdBQUcsQ0FBQyxVQVExRCxFQUFjLEVBQUUsQ0FBQyxZQUFZLENBQUM7SUFDN0IsYUFBYSxFQUFFLENBQUM7SUFDaEIsT0FBTyxFQUFFLCtCQUErQjtJQUN4QyxVQUFVLEVBQUUsVUFBVSxDQUFDLFVBQVU7SUFDakMsS0FBSyxFQUFFLFVBQVUsQ0FBQyxLQUFLO0lBQ3ZCLFVBQVUsRUFBRSxVQUFVLENBQUMsVUFBVTtJQUNqQyxTQUFTLEVBQUUsVUFBVSxDQUFDLFNBQVM7SUFDL0IsR0FBRyxFQUFFLFVBQVUsQ0FBQyxHQUFHO0lBQ25CLFFBQVEsRUFBRSx1QkFBdUIsQ0FBQyxVQUFVLENBQUMsUUFBUSxDQUFDO0lBQ3RELFVBQVUsRUFBRSxVQUFVLENBQUMsVUFBVTtRQUMvQixDQUFDLENBQUMsRUFBRSxRQUFRLEVBQUUsVUFBVSxDQUFDLFVBQVUsQ0FBQyxRQUFRLEVBQUUsS0FBSyxFQUFFLFVBQVUsQ0FBQyxVQUFVLENBQUMsS0FBSyxFQUFFO1FBQ2xGLENBQUMsQ0FBQyxJQUFJO0NBQ1QsQ0FBQyxDQUFDO0FBRUgsTUFBTSxDQUFDLE1BQU0sMkNBQTJDLEdBQUcsQ0FBQyxVQWMzRCxFQUFjLEVBQUUsQ0FBQyxZQUFZLENBQUM7SUFDN0IsYUFBYSxFQUFFLENBQUM7SUFDaEIsT0FBTyxFQUFFLHFDQUFxQztJQUM5QyxjQUFjLEVBQUUsVUFBVSxDQUFDLGNBQWM7SUFDekMsY0FBYyxFQUFFLFVBQVUsQ0FBQyxjQUFjO0lBQ3pDLFNBQVMsRUFBRSxVQUFVLENBQUMsU0FBUztJQUMvQixTQUFTLEVBQUUsVUFBVSxDQUFDLFNBQVM7SUFDL0IsY0FBYyxFQUFFLFVBQVUsQ0FBQyxjQUFjO0lBQ3pDLHNCQUFzQixFQUFFLFVBQVUsQ0FBQyxzQkFBc0I7SUFDekQsb0JBQW9CLEVBQUUsVUFBVSxDQUFDLG9CQUFvQjtJQUNyRCxlQUFlLEVBQUUsVUFBVSxDQUFDLGVBQWU7SUFDM0MsdUJBQXVCLEVBQUUsVUFBVSxDQUFDLHVCQUF1QjtJQUMzRCxVQUFVLEVBQUUsVUFBVSxDQUFDLFVBQVU7SUFDakMsY0FBYyxFQUFFLFVBQVUsQ0FBQyxjQUFjO0lBQ3pDLFFBQVEsRUFBRSxVQUFVLENBQUMsUUFBUTtJQUM3QixlQUFlLEVBQUUsVUFBVSxDQUFDLGVBQWU7Q0FDNUMsQ0FBQyxDQUFDO0FBRUgsTUFBTSxDQUFDLE1BQU0sK0NBQStDLEdBQUcsQ0FBQyxVQU8vRCxFQUFjLEVBQUUsQ0FBQyxZQUFZLENBQUM7SUFDN0IsYUFBYSxFQUFFLENBQUM7SUFDaEIsT0FBTyxFQUFFLGtEQUFrRDtJQUMzRCxZQUFZLEVBQUUsVUFBVSxDQUFDLFlBQVk7SUFDckMsU0FBUyxFQUFFLFVBQVUsQ0FBQyxTQUFTO0lBQy9CLGNBQWMsRUFBRSxVQUFVLENBQUMsY0FBYztJQUN6QyxTQUFTLEVBQUUsVUFBVSxDQUFDLFNBQVM7SUFDL0IsVUFBVSxFQUFFLFVBQVUsQ0FBQyxVQUFVO0lBQ2pDLFNBQVMsRUFBRSxVQUFVLENBQUMsU0FBUztDQUNoQyxDQUFDLENBQUMifQ==